All Apps and Add-ons

Do not index lines

henrikstorm
New Member

I have a setup with two dhcp servers, one Active and one hot-standby server (both running Windows 2012R2)
I have installed the Microsoft Windows DHCP Addon for splunk in my splunk environment and created below inputs.conf file

inputs.conf

[monitor://C:\Windows\System32\dhcp]
sourcetype = dhcp
crcSalt = source
alwaysOpenFile = 1
disabled = false
whitelist = DhcpSrvLog*
index=test-windows

props.conf

[source::C:\Windows\System32\dhcp\DhcpSrvLog-Sat.log]
TRANSFORMS-set= setnull,setparsing

transforms.conf

[setnull]
REGEX = (?i-s)^.*\bstandby\b.*\R
DEST_KEY = queue
FORMAT = nullQueue

[setparsing]
REGEX =.
DEST_KEY=queue
FORMAT=indexQueue

The goal I want to achieve is to not log the lines with "standby"...

I have tried to achieve the goal with above props.conf and transforms.conf, but I feel a bit ignored by my splunk 😉

below a small part of my test log from the passive (standby) server.

24,04/06/19,13:21:09,Database Cleanup Begin,,,,,0,6,,,,,,,,,0
25,04/06/19,13:21:09,0 leases expired and 0 leases deleted,,,,,0,6,,,,,,,,,0
25,04/06/19,13:21:09,0 leases expired and 0 leases deleted,,,,,0,6,,,,,,,,,0
36,04/06/19,13:37:17,Packet dropped because of Client ID hash mismatch or standby server.,192.168.1.0,,00155DBE312E,,0,6,,,,,,,,,0
36,04/06/19,13:38:45,Packet dropped because of Client ID hash mismatch or standby server.,192.168.1.0,,00155DBE312E,,0,6,,,,,,,,,0
36,04/06/19,13:41:47,Packet dropped because of Client ID hash mismatch or standby server.,192.168.1.0,,00155DBE312E,,0,6,,,,,,,,,0

I feel i have done as described in the question "How do you exclude all lines with INFO or WARN from being indexed?" but I just can't get it to work.
Any help would be greatly appreciated.

best regards
Hstorm

0 Karma

woodcock
Esteemed Legend

You are confusing the 2 examples on this page:
https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad

This is the difference:
1: When you are keeping only a few logs, you send them all to the nullQueue using RegEx=. and then pull some of them back using RexEx=<match some>.
2: When you are trashing only a few logs, you send some of them to the nullQueue using RegEx=<match some> and that's it.

What you were doing was sending some of them to the nullQueue but them pulling all of them back out! So your trash can was connected to your front door, accomplishing nothing. To fix it, simply remove all of your setparsing stuff!

0 Karma

henrikstorm
New Member

This works but was not what i wanted

props.conf

[dhcp] 
TRANSFORMS-dhcp_set= dhcp_set_parsing,dhcp_set_null

1. I do not understand why I can not use *[source::C:\Windows\System32\dhcp\DhcpSrvLog*]** instead of [dhcp] ?*
2. Important to have **dhcp_set_parsing* before dhcp_set_null as both are applied in the order they are written, correct ?*


transforms.conf

[dhcp_set_null]
#REGEX = (?i-s)^.*\bstandby\b.*\R
REGEX = standby
DEST_KEY = queue
FORMAT = nullQueue

[dhcp_set_parsing]
REGEX =.
DEST_KEY=queue
FORMAT=indexQueue

3. is there a rule i have not found, that the stanzas used has to start with the sourcetype? as I can only make it work if i use the names dhcp_set_XXX and not if I use only set_XXX ?

Would very much appreciate if anyone can explain 1,2 and 3, as I have spend far too much time trying to figure this, and still don't understand why all the examples I found was structured as my first attempt.

0 Karma

henrikstorm
New Member

The source in props.conf should be [source::C:\Windows\System32\dhcp\DhcpSrvLog*]

0 Karma
Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...