Getting Data In

Discard log lines that do not start with a timestamp

mslvrstn
Communicator

Is there a property that would allow me to discard log lines that don't start with a timestamp? I realize that I can nullqueue them based on not matching a pattern, but I thought I remembered seeing something specifically pre-defined for timestamps.

Thanks

Tags (2)
0 Karma
1 Solution

Stephen_Sorkin
Splunk Employee
Splunk Employee

No, there is no special way to handle this other than to use a regex to direct the lines to the null queue.

View solution in original post

Stephen_Sorkin
Splunk Employee
Splunk Employee

No, there is no special way to handle this other than to use a regex to direct the lines to the null queue.

Get Updates on the Splunk Community!

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...

Application management with Targeted Application Install for Victoria Experience

Experience a new era of flexibility in managing your Splunk Cloud Platform apps! With Targeted Application ...