Getting Data In

Drop specific event

Norling80
Path Finder

Hi

I have a log that we are indexing, now we want to drop specific events from it by sending it to the nullQueue. if an event contains any of the following it should be dropped:

Redirecting the request
Redirecting the call
at

any idea what the transforms/props.conf need to look like?

0 Karma
1 Solution

rphillips_splk
Splunk Employee
Splunk Employee

On your indexers

props.conf
[source::.../opt/splunkforwarder/customerlogs/syslog/filter.log]
TRANSFORMS-null = setnull

transforms.conf
[setnull]
REGEX = (Redirecting the request|Redirecting the call at)
DEST_KEY = queue
FORMAT = nullQueue

If you are sending the events to a heavy forwarder before sending them to your indexers, these props & transforms will need to live on your heavy forwarder and not the indexers.

you can also use a sourcetype or host stanza in props.conf instead of source::

View solution in original post

rphillips_splk
Splunk Employee
Splunk Employee

On your indexers

props.conf
[source::.../opt/splunkforwarder/customerlogs/syslog/filter.log]
TRANSFORMS-null = setnull

transforms.conf
[setnull]
REGEX = (Redirecting the request|Redirecting the call at)
DEST_KEY = queue
FORMAT = nullQueue

If you are sending the events to a heavy forwarder before sending them to your indexers, these props & transforms will need to live on your heavy forwarder and not the indexers.

you can also use a sourcetype or host stanza in props.conf instead of source::

Norling80
Path Finder

Works great, thanks!

0 Karma
Get Updates on the Splunk Community!

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...