Getting Data In

Discarding log entries by specific content

Explorer

In /var/log/messages on numerous machines I have the following messages:

Jun 13 19:55:34 hostabc snmpd[27898]: Received SNMP packet(s) from UDP: [p.q.r.s]:46999 
Jun 13 19:55:34 hostabc snmpd[27898]: Connection from UDP: [p.q.r.s]:46999 

I just want to eradicate these particular messages. I Ideally, I would like to not have them forwarded from to the indexers in the first place, but as a first goal I just want to stop them being indexed.

Taking my cues from Splunk online docs I have made config additions on both the indexers:

In etc/local/props.conf:

[source::/var/log/messages]
TRANSFORMS-null= ditchCacti

In etc/local/transforms.conf:

[ditchCacti]
REGEX = from UDP: \[p.q.r.s\]:
DEST_KEY = queue
FORMAT = nullQueue

Splunk has been restarted, but the offending messages continue to be indexed.

Am I on the right track, or have I completely misunderstood something?

Splunk Employee
Splunk Employee

You are on the right track but the regex is not matching. The periods in p.q.r.s need to be escaped and account for the spaces. I think this should work for you.

REGEX = from\sUDP:\s\[p\.q\.r\.s\]:
0 Karma

Explorer

The configs are indeed on the indexers.

It is only specific messages I want to lose, so diverting an entire sourcetype to the black hole is not suitable. (As you might guess - only the Cacti polling. Any other unexpected SNMP I want to see.)

0 Karma

Splunk Employee
Splunk Employee

You may try routing based on sourcetype. Whatever sourcetype you have configured in inputs.conf. Try that in props.conf instead of the source.

[mysourcetype]
TRANSFORMS-null= ditchCacti

0 Karma

Splunk Employee
Splunk Employee

That is true, yes, i'm particular about how I do my regex to avoid any issues though. Everything I see looks correct assuming these config files are on the indexer.

0 Karma

Explorer

I can understand the spaces needing escaping, but whilst it is sloppy I would have expected '.' in the regex to match anything, including a literal ".".

It hasn't worked, BTW.

0 Karma