Getting Data In

Half event to index queue and half event to null queue

bharathkumarnec
Contributor

Hi All,

Is there a possibility to send half of the event to index queue and half of the event to null queue??

Can this be done based on the size of the event, for example only 1Kb event should be indexed out of 1MB event and rest should be sent to null queue.

Thanks in advance for your inputs!

Regards,
BK

0 Karma

woodcock
Esteemed Legend

You have 2 options:
1: Have Splunk split it into 2 events and then throw away one of them. This is silly.
2: Use SEDCMD to strip the bad part of the event and replace it with nothing. This rocks.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi bharathkumarnec,
you can use TRUNCATE in props.conf to limit the lenght of each event of a specified sourcetype.
Bye.
Giuseppe

0 Karma

bharathkumarnec
Contributor

Hi,

I have tried using Truncate in props.conf, but it did not help me out.

The logs are from kafka topic events.

Regards,
BK

0 Karma

gcusello
SplunkTrust
SplunkTrust

with TRUNCATE you define the max lenght of your events.
If you can define a point of your events (e.g. a word or some chars) that you can use in a regex you can delete all chars after this word or chars.
Bye.
Giuseppe

0 Karma

bharathkumarnec
Contributor

My data is in JSON format, will regex take care of this for JSON events??

0 Karma

gcusello
SplunkTrust
SplunkTrust

with regex you can parse every event, can you share an example of your logs?
Bye.
Giuseppe

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...