Getting Data In

How do I ignore a string of asterisks ("*") in props.conf?

Explorer

Hello I am trying to ignore a string of ***** that are showing up in my data. The asterisks are showing up before Processing Interface system: and after Processed Interface System.

This is the data sample:

*************************************************


Processing Interface system: SOME STRING HERE ...

Command: DUMMY DATA HERE

Connecting to IP.ADDRESS.HERE...
NO FILE(s) EXIST ON REMOTE DIRECTORY: SOME PATH HERE..

Processed Interface System   : SOME STRING HERE

*************************************************


Processing Interface system: SOME STRING HERE ...

Command: DUMMY DATA HERE

Connecting to IP.ADDRESS.HERE...
NO FILE(s) EXIST ON REMOTE DIRECTORY: SOME PATH HERE..

Processed Interface System   : SOME STRING HERE

*************************************************

My Props.conf:

SHOULD_LINEMERGE=true
NO_BINARY_CHECK=true
BREAK_ONLY_BEFORE=\w{10,} \w{9} \w{6}:
MUST_BREAK_AFTER=\w{9} \w{9} \w{6}  

I am breaking the events off of: Processing Interface system and must break after:Processed Interface System. This is how the customer wants the data broken up by. We are totally ignoring the timestamps,

How can I also ignore the ********* that are showing up as "events" in Splunk?

Thanks!

0 Karma
1 Solution

Revered Legend

You can either use SEDCMD command in props.conf to remove thos (make the event with asterisk as blank so that Splunk will drop those) or use props-transforms to route those events to nullQueue (won't be indexed.)

SEDCMD
props.conf

[yourSourcetype]
SHOULD_LINEMERGE=true
NO_BINARY_CHECK=true
BREAK_ONLY_BEFORE=\w{10,} \w{9} \w{6}:
MUST_BREAK_AFTER=\w{9} \w{9} \w{6}  
SEDCMD-removejunk = s/^\*+.+//g

Props-transforms
props.conf

[yourSourcetype]
SHOULD_LINEMERGE=true
NO_BINARY_CHECK=true
BREAK_ONLY_BEFORE=\w{10,} \w{9} \w{6}:
MUST_BREAK_AFTER=\w{9} \w{9} \w{6} 
TRANSFORMS-removejunk = remove_asterisks_line

transforms.conf

[remove_asterisks_line]
REGEX = ^\*+
FORMAT = nullQueue
DEST_KEY = queue

View solution in original post

Revered Legend

You can either use SEDCMD command in props.conf to remove thos (make the event with asterisk as blank so that Splunk will drop those) or use props-transforms to route those events to nullQueue (won't be indexed.)

SEDCMD
props.conf

[yourSourcetype]
SHOULD_LINEMERGE=true
NO_BINARY_CHECK=true
BREAK_ONLY_BEFORE=\w{10,} \w{9} \w{6}:
MUST_BREAK_AFTER=\w{9} \w{9} \w{6}  
SEDCMD-removejunk = s/^\*+.+//g

Props-transforms
props.conf

[yourSourcetype]
SHOULD_LINEMERGE=true
NO_BINARY_CHECK=true
BREAK_ONLY_BEFORE=\w{10,} \w{9} \w{6}:
MUST_BREAK_AFTER=\w{9} \w{9} \w{6} 
TRANSFORMS-removejunk = remove_asterisks_line

transforms.conf

[remove_asterisks_line]
REGEX = ^\*+
FORMAT = nullQueue
DEST_KEY = queue

View solution in original post

Explorer

somesoni2,

This worked like a charm. Thank you for providing two separate configurations. I went ahead and went the transforms route.

Thanks again.

0 Karma

Builder

Are you looking to prevent those asterisk lines from being indexed at all? If so, have a look at
https://answers.splunk.com/answers/232641/is-there-a-way-to-ignore-certain-events.html

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!