Getting Data In

Filtering out data

anandhalagarasa
Path Finder

Hi Team,

We want to filter out the data during indexing time itself if the particular pattern (com.splunk.application) is captured in log. Hence kindly let us know what would be the props and transforms for the same. And the remaining data should ingest into splunk without any issues.

Pattern: If the keyword is present "com.splunk.application" in the event then it should not be indexed.

Sample Event:

DEBUG 2019-10-18 18:43:32,487 [I/O marker 01] com.splunk.applicationinsights.web.url.https.implementation.xxx.client.Maininstallerprog - [ad: 1] Response
processed

DEBUG 2019-10-18 18:43:32,487 [I/O marker 01] com.splunk.applicationinsights.web.url.https.implementation.xx.client.Internalmessage - [ex: 1] releasing connection

Tags (1)
0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

@anandhalagarasan

Can you please below configs?

props.conf

[YOUR_SOURCETYPE]
TRANSFORMS-null= setnull

transforms.conf

[setnull]
SOURCE_KEY=_raw
REGEX = (com.splunk.application)
DEST_KEY = queue
FORMAT = nullQueue

Note: Do change regular expression if required.

View solution in original post

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@anandhalagarasan

Can you please below configs?

props.conf

[YOUR_SOURCETYPE]
TRANSFORMS-null= setnull

transforms.conf

[setnull]
SOURCE_KEY=_raw
REGEX = (com.splunk.application)
DEST_KEY = queue
FORMAT = nullQueue

Note: Do change regular expression if required.

0 Karma

anandhalagarasa
Path Finder

Thanks kamlesh it works like a charm.

0 Karma

anandhalagarasa
Path Finder

Hi Team,

Can you kindly help on this.

0 Karma
Get Updates on the Splunk Community!

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...