Deployment Architecture

splunk 6 forwarder headers?

Champion

Hi,

I seem to recall hearing about some new features in Splunk 6, where we can define "headers" that should be ignored by the forwarder. Am I imagining things? I can't find any doc that might show those features.

Tags (2)
0 Karma

SplunkTrust
SplunkTrust

As long as your junk matches a PREAMBLE_REGEX setting, it should be filtered out.

For example, IIS might have this:

PREAMBLE_REGEX = ^#
0 Karma

Champion

Thanks. I was hoping it worked similar to some awk functions, where you could identify the start of a section and the end of a section.

0 Karma

SplunkTrust
SplunkTrust

Any line that starts with "#" will be removed. I don't think it knows about "start" and "end" of a preamble.

0 Karma

Champion

Thanks. Do I need to enter regex for each line (which stinks), or is there a way to signify the start of the preamble and the end of the preamble?

0 Karma

Champion

looking for examples on using the preamble_regex. Can I specify a start section/end section?

For example:

Line 1 preamble...
junk
more junk
even more junk
end of preamble

Is there a way to filter all that out?

0 Karma

SplunkTrust
SplunkTrust

Can you define "headers"? What OS? What log sources?

0 Karma