Getting Data In

How do I ignore a string of asterisks ("*") in props.conf?

a548506
Path Finder

Hello I am trying to ignore a string of ***** that are showing up in my data. The asterisks are showing up before Processing Interface system: and after Processed Interface System.

This is the data sample:

*************************************************


Processing Interface system: SOME STRING HERE ...

Command: DUMMY DATA HERE

Connecting to IP.ADDRESS.HERE...
NO FILE(s) EXIST ON REMOTE DIRECTORY: SOME PATH HERE..

Processed Interface System   : SOME STRING HERE

*************************************************


Processing Interface system: SOME STRING HERE ...

Command: DUMMY DATA HERE

Connecting to IP.ADDRESS.HERE...
NO FILE(s) EXIST ON REMOTE DIRECTORY: SOME PATH HERE..

Processed Interface System   : SOME STRING HERE

*************************************************

My Props.conf:

SHOULD_LINEMERGE=true
NO_BINARY_CHECK=true
BREAK_ONLY_BEFORE=\w{10,} \w{9} \w{6}:
MUST_BREAK_AFTER=\w{9} \w{9} \w{6}  

I am breaking the events off of: Processing Interface system and must break after:Processed Interface System. This is how the customer wants the data broken up by. We are totally ignoring the timestamps,

How can I also ignore the ********* that are showing up as "events" in Splunk?

Thanks!

0 Karma
1 Solution

somesoni2
Revered Legend

You can either use SEDCMD command in props.conf to remove thos (make the event with asterisk as blank so that Splunk will drop those) or use props-transforms to route those events to nullQueue (won't be indexed.)

SEDCMD
props.conf

[yourSourcetype]
SHOULD_LINEMERGE=true
NO_BINARY_CHECK=true
BREAK_ONLY_BEFORE=\w{10,} \w{9} \w{6}:
MUST_BREAK_AFTER=\w{9} \w{9} \w{6}  
SEDCMD-removejunk = s/^\*+.+//g

Props-transforms
props.conf

[yourSourcetype]
SHOULD_LINEMERGE=true
NO_BINARY_CHECK=true
BREAK_ONLY_BEFORE=\w{10,} \w{9} \w{6}:
MUST_BREAK_AFTER=\w{9} \w{9} \w{6} 
TRANSFORMS-removejunk = remove_asterisks_line

transforms.conf

[remove_asterisks_line]
REGEX = ^\*+
FORMAT = nullQueue
DEST_KEY = queue

View solution in original post

somesoni2
Revered Legend

You can either use SEDCMD command in props.conf to remove thos (make the event with asterisk as blank so that Splunk will drop those) or use props-transforms to route those events to nullQueue (won't be indexed.)

SEDCMD
props.conf

[yourSourcetype]
SHOULD_LINEMERGE=true
NO_BINARY_CHECK=true
BREAK_ONLY_BEFORE=\w{10,} \w{9} \w{6}:
MUST_BREAK_AFTER=\w{9} \w{9} \w{6}  
SEDCMD-removejunk = s/^\*+.+//g

Props-transforms
props.conf

[yourSourcetype]
SHOULD_LINEMERGE=true
NO_BINARY_CHECK=true
BREAK_ONLY_BEFORE=\w{10,} \w{9} \w{6}:
MUST_BREAK_AFTER=\w{9} \w{9} \w{6} 
TRANSFORMS-removejunk = remove_asterisks_line

transforms.conf

[remove_asterisks_line]
REGEX = ^\*+
FORMAT = nullQueue
DEST_KEY = queue

a548506
Path Finder

somesoni2,

This worked like a charm. Thank you for providing two separate configurations. I went ahead and went the transforms route.

Thanks again.

0 Karma

mfrost8
Builder

Are you looking to prevent those asterisk lines from being indexed at all? If so, have a look at
https://answers.splunk.com/answers/232641/is-there-a-way-to-ignore-certain-events.html

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...