Splunk Add-on for ServiceNow: How to exclude logs where URL field values does not begin with a "/"?

[Log_wrangler]

Looking for a conf example and some advice on limiting API calls to not include events where a field contains or does not contain a certain value.

So my first question is:
When I configure ... /etc/apps/Splunk_TA_snow/local inputs.conf to "filter" will that discard events NOT containing the specified values from being indexed AND from the API call? I am thinking it should be filter_data = url="/*" to GET and index only events with a url that starts with "/"...

Can anyone share an example using the "Excluded properties" option excluding events with a field "url" (from [snow://syslog_transaction] where the value does not contain a url starting "/"?

Thank you

[deepashri_123 · Accepted solution]

Hey Log_wrangler,

You can refer to the doc below:
http://docs.splunk.com/Documentation/Splunk/7.0.2/Forwarding/Routeandfilterdatad#Discard_specific_ev...

[Log_wrangler]

Thank you for the link, I was actually trying to use the snow ta conf only.

[deepashri_123]

If that helped you can accept the answer 🙂