Getting Data In

Filter events while sending data from Heavy Forwarder to Indexer

rodneyjerome
Explorer

Hi,

I have an HFW and indexer in my environment. I'm looking to filter certain events from the log source in HFW based on REGEX while indexing in the indexer. 

Please find below the config files. Not sure where I'm going wrong.

 

props.conf

[testing]

TRANSFORMS-routing = conGroup

 

inputs.conf

[monitor:///var/logs]

disabled = false

index = main

sourcetype =. testing

host = HFW

 

 

transforms.conf

[conGroup]

REGEX = ^(((?!i-)(?!sample)).)*$

DEST_KEY=_TCP_ROUTING

FORMAT=test

 

outputs.conf

[tcpout]

defaultGroup = nothing

 

[tcpout:test]

server = X.X.X.X:9997

 

Any help will be. much appreciated. Thanks in advance

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @rodneyjerome,

let me understand: do you want to send only a part of logs to Indexers or discard eventd?

Anyway the location of your filters is only the HF, On Indexers arrive already parsed events so it isn't possible filter them.

You can find the way to filter events at https://docs.splunk.com/Documentation/SplunkCloud/8.1.2012/Forwarding/Routeandfilterdatad#Filter_eve...

Ciao.

Giuseppe

 

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @rodneyjerome,

let me understand: do you want to send only a part of logs to Indexers or discard eventd?

Anyway the location of your filters is only the HF, On Indexers arrive already parsed events so it isn't possible filter them.

You can find the way to filter events at https://docs.splunk.com/Documentation/SplunkCloud/8.1.2012/Forwarding/Routeandfilterdatad#Filter_eve...

Ciao.

Giuseppe

 

rodneyjerome
Explorer

Thanks. This worked great!

0 Karma

scelikok
SplunkTrust
SplunkTrust

 Hi @rodneyjerome,

On your props.conf TRANSFORM is pointing to wrong stanza.

Please try this;

[testing]

TRANSFORMS-routing = conGroup
If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma
Get Updates on the Splunk Community!

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...

What’s New in Splunk Observability Cloud – June 2025

What’s New in Splunk Observability Cloud – June 2025 We are excited to announce the latest enhancements to ...

Almost Too Eventful Assurance: Part 2

Work While You SleepBefore you can rely on any autonomous remediation measures, you need to close the loop ...