Splunk Search

Skipping Index after transformation

kkamatchisundar
New Member

I have certain logs in which I had to change the format of the logs.For this a custom sourcetype containing the transformation regex was created and applied over the logs.
Now done with the transformation.But the problem is I dont want these transformed logs to undergo the indexing process.
Also I want these transformed logs to be directed to an external file wihtout getting stored in splunk.How to do this in splunk.

Please advise.

Tags (2)
0 Karma

Ayn
Legend

You can't do this in Splunk. Logs that are entered into Splunk are either indexed, forwarded or dropped. Your option might be to forward it via TCP or similar to a third party system that then writes it to file, but it sounds to me you're looking for the wrong tool for the wrong job.

Get Updates on the Splunk Community!

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...