I seem to recall hearing about some new features in Splunk 6, where we can define "headers" that should be ignored by the forwarder. Am I imagining things? I can't find any doc that might show those features.
As long as your junk matches a PREAMBLE_REGEX setting, it should be filtered out.
For example, IIS might have this:
PREAMBLE_REGEX = ^#
Thanks. I was hoping it worked similar to some awk functions, where you could identify the start of a section and the end of a section.
Any line that starts with "#" will be removed. I don't think it knows about "start" and "end" of a preamble.
Thanks. Do I need to enter regex for each line (which stinks), or is there a way to signify the start of the preamble and the end of the preamble?
looking for examples on using the preamble_regex. Can I specify a start section/end section?
Line 1 preamble...
even more junk
end of preamble
Is there a way to filter all that out?
Can you define "headers"? What OS? What log sources?