topic How to start conditional logging from Universal forwarder on Splunk in Splunk Search

How to start conditional logging from Universal forwarder on Splunk

ayushchoudhary — Tue, 15 Mar 2016 16:17:31 GMT

I have a server of which logs are indexed on splunk. The server is universal forwarder and sends a log file continuously to the Splunk to index. The logs have a lot of events with "INFO". I require that the events with "INFO" should be discarded and will not indexed by splunk.
To attain the same i had made following changes on Indexer as my forwarder is universal forwarder.

Path: /opt/splunk/etc/apps/search/local/props.conf
[host::abcd.global.trafigura.com]
sourcetype = abcd Log
TRANSFORMS-null= setnull, setparsing

Path: /opt/splunk/etc/apps/search/local/transforms.conf
[setnull]
REGEX = INFO
DEST_KEY = queue
FORMAT = nullQueue

[setparsing]
REGEX = .
DEST_KEY = queue

FORMAT = indexQueue

But i'm not able to discard the events with INFO. Please help.

Re: How to start conditional logging from Universal forwarder on Splunk

somesoni2 — Tue, 15 Mar 2016 18:44:21 GMT

Check if the host name is correct? IMO, the setparsing stanza is not required. Hope you restarted your indexer after making this change.
Also, routing and filtering for structured data happens on UF itseft so can you confirm if your log data is structured or not. (see this http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad#Caveats_for_routing_and_filtering_structured_data)

Re: How to start conditional logging from Universal forwarder on Splunk

martin_mueller — Tue, 15 Mar 2016 22:07:37 GMT

Remove the setparsing part - that's for the opposite, "remove everything except the regex in the setparsing stanza". In your case, the dot matches everything so it keeps everything.

TRANSFORMS-null = setnull

As a general advice, make sure your regex INFO doesn't accidentally discard events that are of loglevel ERROR but happen to contain INFO somewhere else.