Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Re: Getting rid of unwanted events
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Getting rid of unwanted events
Hi, I am trying to get rid of 2 events from a XML file I am trying to ingest,
I am editing the transforms.conf to send 2 events to the null queue,
the 2 events I am trying to get off are the and (an example of the XML file is below)
-80.33100097073213,25.10742916222947
Interdiction
23
Ironwood
2013-04-24
00:07:00
0
-80.23429525620114,24.08680387475695
Rustic
so my transform is able to get rid of the tag but I cannot get rid of the tag
my props.conf for this sourcetype looks like
[dreamcrusher]
DATETIME_CONFIG =
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = true
category = Custom
pulldown_type = 1
BREAK_ONLY_BEFORE =
LINE_BREAKER =
TRUNCATE = 5000
disabled = false
TRANSFORMS-datarootnull = DATAROOTNULL
MUST_BREAK_AFTER =
and my transforms.conf for this transform looks like
[2DATAROOTNULL]
REGEX = <.*?dataroot>
DEST_KEY = queue
FORMAT = nullQueue
any help would be greatly appreciated!
Thanks
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
had to use sedcmd command in the props.conf file, all good
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
got the answer, i had to make a sedcmd command in the props 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It looks like some text is not displayed properly.
Can you use the "Code Sample" function instead?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
its all good dude, managed to get there in the end
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Then please post your solution as an answer and mark that as accepted, such that it is clear that this question is resolved 🙂
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas
What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)
Automating Threat Operations and Threat Hunting with Recorded Future
