Getting Data In

Filter & Ingest Data

Karthikeyan
Engager

Hi Experts,

I have specific requirement to split the contents of a file and ingest it as a separate events. In that events, a filter to be applied and ingest the filtered data to Splunk indexer.

I have created a REGEX pattern which split the contents of the file and ingesting the data in to separate events as desired. Now, my issue is with the filtering of ingested data. In each event, I need to filter fro AGGREGATED_EXECUTION and ingest only the event which has that content. I set the configuration as below.

props.conf:
[expensive_statements]
TRANSFORMS-set= send_events

 

transforms.conf:
[send_events]
REGEX = AGGREGATED_EXECUTION
DEST_KEY = queue
FORMAT = indexQueue

 

Above settings is made on HF. Still the filtering is not happening as expected. Kindly help in resolving the issue with filtering.

 

Regards, Karthikeyan.SV

Labels (3)
0 Karma

shivanshu1593
Builder

Instead of re-starting splunkd on the search head, try restarting the splunkd service on the Heavy Forwarder, where the changes have been made and then check if the results are effective.

 

If not, btool can tell if the configuration is really being loaded in the memory or not. 

Thanks,

****If it helped, please upvote and accept it as a solution. It helps others to find the solution more quickly in the future****

 

 

 

Thank you,
Shiv
###If you found the answer helpful, kindly consider upvoting/accepting it as the answer as it helps other Splunkers find the solutions to similar issues###
0 Karma

Karthikeyan
Engager

I restarted SH after making the changes. Still the new props is not effected.

0 Karma

codebuilder
Influencer

Did you either restart the SHC/SH after making the changes?

Or you can run the following in the search bar to get the same results:

|rest /services/authentication/users splunk_server=local

----
An upvote would be appreciated and Accept Solution if it helps!
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...