I am trying to prune some noise from my logs. Here are my props.conf and transforms.conf. Any Idea what I am missing. The dhcpcd messages are still getting through.
# more props.conf [source::/var/log/hosts] # Transforms must be applied in this order # to make sure events are dropped on the # floor prior to making their way to the # index processor TRANSFORMS-set= setnull,setparsing # vi transforms.conf [sendmailnull] REGEX = .*sendmail.*$ DEST_KEY = queue FORMAT = nullQueue [puppetdnull] REGEX = .*puppetd.* DEST_KEY = queue FORMAT = nullQueue [setnull] REGEX = .*dhcpcd.* DEST_KEY = queue FORMAT = nullQueue
setparsingcontain? Might it have something that overrides the
Yes, I restart splunk after each edit. Yes, all of the files are in /var/log/hosts. Yes it is dhcpcd. Here is a sample. Nov 2 14:13:33 STORE00046-BACKUP dhcpcd: usb0: cannot request a link local address. Setparsing actually is not in use anywhere. I grabbed that config from another example in this forum. That may be part of the problem. I read a reference to inputs.conf somewhere but don't understand the link.
I did notice that when I make the changes the volume does seem to drop (but not disappear completely) that day, then after midnight, it seems to go back up again.
I don't have a test setup to try this on so I cannot verify how Splunk reacts when you specify a transform that does not exist, however removing the "setparsing" reference in props.conf is definitely one step worth trying.