Archive

How to escape the first line having ‘null’ char

New Member

I have a log file ( generated from the WAS server) having the first line like that :
null null null null...
Please help me how to excape that line from the Splunk conf files.

Tags (1)
0 Karma

Splunk Employee
Splunk Employee

I imagine you wan't to discard the first line because it does not have useful date.

Please see this link on how to filter data out to the null queue. You would need to create a regular expression to match the line you want to remove.

http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Routeandfilterdatad#Filter_event_data_and_...

0 Karma

Explorer

"Escape the first line" means the first line of the file contains binary data
Configs:
inputs.conf
[monitor://C:\AEP]
disabled = false
followTail = 0
index = main
sourcetype = log4j
CRCSALT =

props.conf
[log4j]
NO_BINARY_CHECK = True
TRUNCATE = 100000
[source::C:\AEP]
sourcetype = log4j
TRANSFORMS-null= setnull

transforms.conf
[setnull]
REGEX = [\x00]
DEST_KEY = queue
FORMAT = nullQueue

Getting following error.
Access error while handling path: failed to open for checksum: 'C:\AEP\bw-timer-mm.log.3' (The process cannot access the file because it is being used by another process.)

0 Karma

SplunkTrust
SplunkTrust

What do you mean by "escape the first line"?

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!