Hi
I have a log that we are indexing, now we want to drop specific events from it by sending it to the nullQueue. if an event contains any of the following it should be dropped:
Redirecting the request
Redirecting the call
at
any idea what the transforms/props.conf need to look like?
On your indexers
props.conf
[source::.../opt/splunkforwarder/customerlogs/syslog/filter.log]
TRANSFORMS-null = setnull
transforms.conf
[setnull]
REGEX = (Redirecting the request|Redirecting the call at)
DEST_KEY = queue
FORMAT = nullQueue
If you are sending the events to a heavy forwarder before sending them to your indexers, these props & transforms will need to live on your heavy forwarder and not the indexers.
you can also use a sourcetype or host stanza in props.conf instead of source::
On your indexers
props.conf
[source::.../opt/splunkforwarder/customerlogs/syslog/filter.log]
TRANSFORMS-null = setnull
transforms.conf
[setnull]
REGEX = (Redirecting the request|Redirecting the call at)
DEST_KEY = queue
FORMAT = nullQueue
If you are sending the events to a heavy forwarder before sending them to your indexers, these props & transforms will need to live on your heavy forwarder and not the indexers.
you can also use a sourcetype or host stanza in props.conf instead of source::
Works great, thanks!