My splunk instance is indexing lots of console errors performed by a job that I cannot determine. I discarded a time ago the .log files that are in the workspace but now I have 1gb of data indexed by day:
index =jenkins_console
source = logger://org.biouno.unochoice.AbstractUnoChoiceParameter
log_thrown: java.lang.RuntimeException: Failed to evaluate script: No such property: url for class: Script1
How do I determine where is coming from, and then how I fix it or discard these messages ?
Are you using active-choices-plugin ( https://wiki.jenkins.io/display/JENKINS/Active+Choices+Plugin) ? It seems there is a groovy script error in the active choice plugin config
No such property: url for class Script1
I think once you fix the script, the error will gone
@dsmc_adv,
You can add nullqueue to eliminate some events from indexing:
In props.conf,
you add:
[source::/var/log/messages]
TRANSFORMS-null= setnull
And in transforms.conf
:
[setnull]
REGEX = \[things you want to discard\]
DEST_KEY = queue
FORMAT = nullQueue