Hello,
I am currently using the following REGEX for PREAMBLE_REGEX
in props.conf
which works on Splunk 6.4.x running on Windows:
(^|[\r\n])(Job\.Description[^\r\n]+|String[^\r\n]+)
This is used to tell Splunk to skip the second and third lines of log files which always start:
Job.Description,Job.NumJobWaitEvents...
String,Integer,Integer...
I've since migrated my app to a Splunk 6.4.x instance running on Linux, but it doesn't work anymore (the lines aren't ignored). What changes should I be looking out for to ensure that the regular expression works in Linux as well?
Thank you and best regards,
Andrew
Try:
^(Job\.Description.+|String,.+)$
It should work the same way as your regex, but it's simpler. That might make a difference.
Thanks for the input. The REGEX works but doesn't solve the problem. I've found what I was looking for here:
https://answers.splunk.com/answers/209824/how-to-get-splunk-to-ignore-the-second-line-of-a-l.html
Suggestion was to use a null-queue transform by modifying props.conf
and transforms.conf