Drop specific event

[Norling80]

Hi

I have a log that we are indexing, now we want to drop specific events from it by sending it to the nullQueue. if an event contains any of the following it should be dropped:

Redirecting the request
Redirecting the call
at

any idea what the transforms/props.conf need to look like?

[rphillips_splk · Accepted solution]

On your indexers

props.conf
[source::.../opt/splunkforwarder/customerlogs/syslog/filter.log]
TRANSFORMS-null = setnull

transforms.conf
[setnull]
REGEX = (Redirecting the request|Redirecting the call at)
DEST_KEY = queue
FORMAT = nullQueue

If you are sending the events to a heavy forwarder before sending them to your indexers, these props & transforms will need to live on your heavy forwarder and not the indexers.

you can also use a sourcetype or host stanza in props.conf instead of source::

[Norling80]

Works great, thanks!