Getting Data In

DROP and GET events by pattern filters?

verbal_666
Builder

Hi.
I'm trying to apply a rule for dropping and, meanwhile, get only some events in Indexers.

Here we are,

props.conf

 

 

[mysourcetype]
TRANSFORMS-filter = drop

 

 

transforms.conf

 

 

[drop]
REGEX = drop_event1|drop_event2|drop_eventX
DEST_KEY = queue
FORMAT = nullQueue

 

 

 

This is the standard way for dropping. And it works!

 

But, at the same time, i can't get a way to make both work with drop and get transformation,

props.conf

 

 

[mysourcetype]
TRANSFORMS-filter = drop,filter

 

 

transforms.conf

 

 

[drop]
REGEX = drop_event1|drop_event2|drop_eventX
DEST_KEY = queue
FORMAT = nullQueue

[filter]
REGEX = get_event1|get_event2|get_eventX
DEST_KEY = queue
FORMAT = indexQueue

 

 

 

I would like to explain Splunk 8,

  1. FIRST: drop all events containing pattern regex "drop_event1|drop_event2|drop_eventX"
  2. SECOND: get only events containing pattern regex "get_event1|get_event2|get_eventX"

It does not work! Splunk, after correctly dropping, gets all (".*"), except as said "drop_event1|drop_event2|drop_eventX" 😪

Any suggestion?

Labels (1)
Tags (1)
0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...