Skipping Index after transformation

New Member

I have certain logs in which I had to change the format of the logs.For this a custom sourcetype containing the transformation regex was created and applied over the logs.
Now done with the transformation.But the problem is I dont want these transformed logs to undergo the indexing process.
Also I want these transformed logs to be directed to an external file wihtout getting stored in splunk.How to do this in splunk.

Please advise.

Tags (2)
0 Karma

Re: Skipping Index after transformation


You can't do this in Splunk. Logs that are entered into Splunk are either indexed, forwarded or dropped. Your option might be to forward it via TCP or similar to a third party system that then writes it to file, but it sounds to me you're looking for the wrong tool for the wrong job.