Getting Data In

Filter data by props.conf and transform.conf

marco_massari11
Communicator

Hi,

I need to filter out some events from a syslog source. All the events that I need to exclude are like this:

Apr 16 11:24:23 **********  2021-04-16T11:24:23.604+02:00 *************************************** - Modified Query: START TRANSACTION

Can anyone could help?

Thanks in advance

0 Karma
1 Solution

aasabatini
Motivator

Hi @marco_massari11 

props.conf

[source::"your source"]
TRANSFORMS-filter = eventsDrop

 

transforms.conf

[eventsDrop]
REGEX = START\sTRANSACTION
DEST_KEY = queue
FORMAT = nullQueue

to help you better I would need the source and sourcetype info

 

Regards

Alessandro

 

“The answer is out there, Neo, and it’s looking for you, and it will find you if you want it to.”

View solution in original post

aasabatini
Motivator

Hi @marco_massari11 

props.conf

[source::"your source"]
TRANSFORMS-filter = eventsDrop

 

transforms.conf

[eventsDrop]
REGEX = START\sTRANSACTION
DEST_KEY = queue
FORMAT = nullQueue

to help you better I would need the source and sourcetype info

 

Regards

Alessandro

 

“The answer is out there, Neo, and it’s looking for you, and it will find you if you want it to.”

marco_massari11
Communicator

Hi @aasabatini ,

my sourcetype is sourcetype=syslog.

So it should be:

[syslog]
TRANSFORMS-filter = eventsDrop

[eventsDrop]
REGEX = START\sTRANSACTION
DEST_KEY = queue
FORMAT = nullQueue

Is it correct?

Regards

Marco

0 Karma

aasabatini
Motivator

Yes @marco_massari11 , it's correct 
props.conf 

[syslog]
TRANSFORMS-filter = eventsDrop

transforms.conf

[eventsDrop]
REGEX = START\sTRANSACTION
DEST_KEY = queue
FORMAT = nullQueue

Confirmation solution or karma given is appreciated

Alessandro

 

“The answer is out there, Neo, and it’s looking for you, and it will find you if you want it to.”
0 Karma

marco_massari11
Communicator

Hi @aasabatini ,

it seems not working. In my props I have already a: 

[syslog]
TRANSFORMS-null= ****  It exclude an IP in trasnsform.conf.

So I need to do like this?:

[syslog]
TRANSFORMS-null= ****
TRANSFORMS-filter = eventsDrop

 

0 Karma

aasabatini
Motivator

Hi @marco_massari11 

no, you need to put your transformations stanza, separated by comma

example:

 

[syslog]
TRANSFORMS-null= ****,eventsDrop

 

 

consider the possibility to filter only data as you need with regex.



“The answer is out there, Neo, and it’s looking for you, and it will find you if you want it to.”
0 Karma

marco_massari11
Communicator

Hi @aasabatini ,

my app hasn't the flag on Restart Splunkd. So now it should be work

0 Karma

marco_massari11
Communicator

Hi @aasabatini ,

this is my inputs.conf, I don't know if it could help:

[udp://****]
connection_host = ip
index = ***
source = ***
sourcetype = syslog

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...