Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Re: Filter specific data to indexer
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Filter specific data to indexer
Hi,
i do not want to forward the body and the content field to indexer, how to go abt doing it? thks
<xml>
<Field1>123</Field1>
<Field2>456</Field2>
<Body>Not to be forward to indexer</Body>
<Field3>333</Field3>
<content>not to be forward</content>
</xml>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
props.conf and transforms.conf needs to configured on indexer, not at Universal forwarder. If you have heavy forwarder, you can use props.conf and transforms.conf.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
someone had provided me the ans.it worked
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi SplunkCSIT,
take a look at the docs about Filter event data and send to queues. If the wanted and unwanted fields are all in one event, you may need to use this example and instead of replacing the data you blank them out.
In your case you can either set the regex to something like this <Field\d+>(.+)<\/Field\d+> to match and keep only the Field events or set the regex to match (<Body>|<content>)(.+)<\/ and have that removed.
The regex's are untested because I don't have the real world event, so maybe they need some tuning.
Update: and like @linu1988 said, this must be done on a parsing Splunk instance like a Indexer and/or a heavy forarwder.
hope this helps ...
cheers, MuS
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
at props.conf,
[test]
TRANSFORMS-null = content
at transforms.conf,
[content]
REGEX =
DEST_KEY = queue
FORMAT = nullQueue
I configured the props.conf and transforms.conf for both forwarder and indexer but it does not work. Any problem with my config files?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
the props.conf and transforms.conf to be configured at forwarder or indexer?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
first of all you can't filter this not to be forwarded from forwarder. It need to be done on the indexer. Not sure as it is a single event how to apply sedcmd on this
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions
Splunk Community Badges!
[Puzzles] Solve, Learn, Repeat: Matching cron expressions
