Getting Data In

Getting rid of unwanted events

ssjabid
Explorer

Hi, I am trying to get rid of 2 events from a XML file I am trying to ingest,
I am editing the transforms.conf to send 2 events to the null queue,
the 2 events I am trying to get off are the and (an example of the XML file is below)

-80.33100097073213,25.10742916222947
Interdiction
23
Ironwood
2013-04-24
00:07:00

0
-80.23429525620114,24.08680387475695
Rustic

so my transform is able to get rid of the tag but I cannot get rid of the tag

my props.conf for this sourcetype looks like

[dreamcrusher]
DATETIME_CONFIG =
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = true
category = Custom
pulldown_type = 1
BREAK_ONLY_BEFORE =
LINE_BREAKER =
TRUNCATE = 5000
disabled = false
TRANSFORMS-datarootnull = DATAROOTNULL
MUST_BREAK_AFTER =

and my transforms.conf for this transform looks like

[2DATAROOTNULL]
REGEX = <.*?dataroot>
DEST_KEY = queue
FORMAT = nullQueue

any help would be greatly appreciated!
Thanks

0 Karma

ssjabid
Explorer

had to use sedcmd command in the props.conf file, all good

0 Karma

ssjabid
Explorer

got the answer, i had to make a sedcmd command in the props 🙂

0 Karma

whrg
Motivator

It looks like some text is not displayed properly.
Can you use the "Code Sample" function instead?

0 Karma

ssjabid
Explorer

its all good dude, managed to get there in the end

0 Karma

FrankVl
Ultra Champion

Then please post your solution as an answer and mark that as accepted, such that it is clear that this question is resolved 🙂

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...