Getting Data In

Drop specific event

Norling80
Path Finder

Hi

I have a log that we are indexing, now we want to drop specific events from it by sending it to the nullQueue. if an event contains any of the following it should be dropped:

Redirecting the request
Redirecting the call
at

any idea what the transforms/props.conf need to look like?

0 Karma
1 Solution

rphillips_splk
Splunk Employee
Splunk Employee

On your indexers

props.conf
[source::.../opt/splunkforwarder/customerlogs/syslog/filter.log]
TRANSFORMS-null = setnull

transforms.conf
[setnull]
REGEX = (Redirecting the request|Redirecting the call at)
DEST_KEY = queue
FORMAT = nullQueue

If you are sending the events to a heavy forwarder before sending them to your indexers, these props & transforms will need to live on your heavy forwarder and not the indexers.

you can also use a sourcetype or host stanza in props.conf instead of source::

View solution in original post

rphillips_splk
Splunk Employee
Splunk Employee

On your indexers

props.conf
[source::.../opt/splunkforwarder/customerlogs/syslog/filter.log]
TRANSFORMS-null = setnull

transforms.conf
[setnull]
REGEX = (Redirecting the request|Redirecting the call at)
DEST_KEY = queue
FORMAT = nullQueue

If you are sending the events to a heavy forwarder before sending them to your indexers, these props & transforms will need to live on your heavy forwarder and not the indexers.

you can also use a sourcetype or host stanza in props.conf instead of source::

Norling80
Path Finder

Works great, thanks!

0 Karma
Get Updates on the Splunk Community!

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...