I have a Splunk Heavy Forwarder server that is a rsyslog server as well.
When Splunk sees the syslog data, it sets the source type, then the index name before its sent to indexing.
props.conf
[rsyslog]
TRANSFORMS-force_vmware = force_sourcetype_vmware, force_ix_vmware
transforms.conf
force_sourcetype_vmware]
SOURCE_KEY = MetaData:Host
REGEX = ^host::(10\.30\.31\.\d+)
DEST_KEY = MetaData:Sourcetype
FORMAT = sourcetype::esxi
[force_ix_vmware]
SOURCE_KEY = MetaData:Sourcetype
REGEX = ^sourcetype::(?i)esxi$
DEST_KEY = _MetaData:Index
FORMAT = vmware
This works fine.
I now like to remove all lines (that are from vmware) that starts with:
<134>2021.....
<166>2021.....
To do so, I made a regex like this:
REGEX = ^<(134|166)>2021
I know that to remove some, I should use:
DEST_KEY = queue
FORMAT = nullQueue
But I do not get it to work. How to make sure only remove correct data from vmware only?
