Getting Data In

Getting rid of unwanted events

ssjabid
Explorer

Hi, I am trying to get rid of 2 events from a XML file I am trying to ingest,
I am editing the transforms.conf to send 2 events to the null queue,
the 2 events I am trying to get off are the and (an example of the XML file is below)

-80.33100097073213,25.10742916222947
Interdiction
23
Ironwood
2013-04-24
00:07:00

0
-80.23429525620114,24.08680387475695
Rustic

so my transform is able to get rid of the tag but I cannot get rid of the tag

my props.conf for this sourcetype looks like

[dreamcrusher]
DATETIME_CONFIG =
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = true
category = Custom
pulldown_type = 1
BREAK_ONLY_BEFORE =
LINE_BREAKER =
TRUNCATE = 5000
disabled = false
TRANSFORMS-datarootnull = DATAROOTNULL
MUST_BREAK_AFTER =

and my transforms.conf for this transform looks like

[2DATAROOTNULL]
REGEX = <.*?dataroot>
DEST_KEY = queue
FORMAT = nullQueue

any help would be greatly appreciated!
Thanks

0 Karma

ssjabid
Explorer

had to use sedcmd command in the props.conf file, all good

0 Karma

ssjabid
Explorer

got the answer, i had to make a sedcmd command in the props 🙂

0 Karma

whrg
Motivator

It looks like some text is not displayed properly.
Can you use the "Code Sample" function instead?

0 Karma

ssjabid
Explorer

its all good dude, managed to get there in the end

0 Karma

FrankVl
Ultra Champion

Then please post your solution as an answer and mark that as accepted, such that it is clear that this question is resolved 🙂

0 Karma
Get Updates on the Splunk Community!

Best Strategies to Optimize Observability Costs

 Join us on Tuesday, May 6, 2025, at 11 AM PDT / 2 PM EDT for an insightful session on optimizing ...

Fueling your curiosity with new Splunk ILT and eLearning courses

At Splunk Education, we’re driven by curiosity—both ours and yours! That’s why we’re committed to delivering ...

Splunk AI Assistant for SPL 1.1.0 | Now Personalized to Your Environment for Greater ...

Splunk AI Assistant for SPL has transformed how users interact with Splunk, making it easier than ever to ...