Do not index lines

[henrikstorm]

I have a setup with two dhcp servers, one Active and one hot-standby server (both running Windows 2012R2)
I have installed the Microsoft Windows DHCP Addon for splunk in my splunk environment and created below inputs.conf file

inputs.conf

[monitor://C:\Windows\System32\dhcp]
sourcetype = dhcp
crcSalt = source
alwaysOpenFile = 1
disabled = false
whitelist = DhcpSrvLog*
index=test-windows

props.conf

[source::C:\Windows\System32\dhcp\DhcpSrvLog-Sat.log]
TRANSFORMS-set= setnull,setparsing

transforms.conf

[setnull]
REGEX = (?i-s)^.*\bstandby\b.*\R
DEST_KEY = queue
FORMAT = nullQueue

[setparsing]
REGEX =.
DEST_KEY=queue
FORMAT=indexQueue

The goal I want to achieve is to not log the lines with "standby"...

I have tried to achieve the goal with above props.conf and transforms.conf, but I feel a bit ignored by my splunk 😉

below a small part of my test log from the passive (standby) server.

24,04/06/19,13:21:09,Database Cleanup Begin,,,,,0,6,,,,,,,,,0
25,04/06/19,13:21:09,0 leases expired and 0 leases deleted,,,,,0,6,,,,,,,,,0
25,04/06/19,13:21:09,0 leases expired and 0 leases deleted,,,,,0,6,,,,,,,,,0
36,04/06/19,13:37:17,Packet dropped because of Client ID hash mismatch or standby server.,192.168.1.0,,00155DBE312E,,0,6,,,,,,,,,0
36,04/06/19,13:38:45,Packet dropped because of Client ID hash mismatch or standby server.,192.168.1.0,,00155DBE312E,,0,6,,,,,,,,,0
36,04/06/19,13:41:47,Packet dropped because of Client ID hash mismatch or standby server.,192.168.1.0,,00155DBE312E,,0,6,,,,,,,,,0

I feel i have done as described in the question "How do you exclude all lines with INFO or WARN from being indexed?" but I just can't get it to work.
Any help would be greatly appreciated.

best regards
Hstorm

[woodcock]

You are confusing the 2 examples on this page:
https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad

This is the difference:
1: When you are keeping only a few logs, you send them all to the nullQueue using RegEx=. and then pull some of them back using RexEx=<match some>.
2: When you are trashing only a few logs, you send some of them to the nullQueue using RegEx=<match some> and that's it.

What you were doing was sending some of them to the nullQueue but them pulling all of them back out! So your trash can was connected to your front door, accomplishing nothing. To fix it, simply remove all of your setparsing stuff!

[henrikstorm]

This works but was not what i wanted

props.conf

[dhcp] 
TRANSFORMS-dhcp_set= dhcp_set_parsing,dhcp_set_null

1. I do not understand why I can not use *[source::C:\Windows\System32\dhcp\DhcpSrvLog*]** instead of [dhcp] ?*
2. Important to have **dhcp_set_parsing* before dhcp_set_null as both are applied in the order they are written, correct ?*

---

transforms.conf

[dhcp_set_null]
#REGEX = (?i-s)^.*\bstandby\b.*\R
REGEX = standby
DEST_KEY = queue
FORMAT = nullQueue

[dhcp_set_parsing]
REGEX =.
DEST_KEY=queue
FORMAT=indexQueue

3. is there a rule i have not found, that the stanzas used has to start with the sourcetype? as I can only make it work if i use the names dhcp_set_XXX and not if I use only set_XXX ?

Would very much appreciate if anyone can explain 1,2 and 3, as I have spend far too much time trying to figure this, and still don't understand why all the examples I found was structured as my first attempt.

[henrikstorm]

The source in props.conf should be [source::C:\Windows\System32\dhcp\DhcpSrvLog*]