Getting Data In

Filter events while sending data from Heavy Forwarder to Indexer

rodneyjerome
Explorer

Hi,

I have an HFW and indexer in my environment. I'm looking to filter certain events from the log source in HFW based on REGEX while indexing in the indexer. 

Please find below the config files. Not sure where I'm going wrong.

 

props.conf

[testing]

TRANSFORMS-routing = conGroup

 

inputs.conf

[monitor:///var/logs]

disabled = false

index = main

sourcetype =. testing

host = HFW

 

 

transforms.conf

[conGroup]

REGEX = ^(((?!i-)(?!sample)).)*$

DEST_KEY=_TCP_ROUTING

FORMAT=test

 

outputs.conf

[tcpout]

defaultGroup = nothing

 

[tcpout:test]

server = X.X.X.X:9997

 

Any help will be. much appreciated. Thanks in advance

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @rodneyjerome,

let me understand: do you want to send only a part of logs to Indexers or discard eventd?

Anyway the location of your filters is only the HF, On Indexers arrive already parsed events so it isn't possible filter them.

You can find the way to filter events at https://docs.splunk.com/Documentation/SplunkCloud/8.1.2012/Forwarding/Routeandfilterdatad#Filter_eve...

Ciao.

Giuseppe

 

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @rodneyjerome,

let me understand: do you want to send only a part of logs to Indexers or discard eventd?

Anyway the location of your filters is only the HF, On Indexers arrive already parsed events so it isn't possible filter them.

You can find the way to filter events at https://docs.splunk.com/Documentation/SplunkCloud/8.1.2012/Forwarding/Routeandfilterdatad#Filter_eve...

Ciao.

Giuseppe

 

rodneyjerome
Explorer

Thanks. This worked great!

0 Karma

scelikok
SplunkTrust
SplunkTrust

 Hi @rodneyjerome,

On your props.conf TRANSFORM is pointing to wrong stanza.

Please try this;

[testing]

TRANSFORMS-routing = conGroup
If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...