Getting Data In

How do I remove the lines with INFO or WARN from logging to Splunk?

nls7010
Path Finder

I want to NOT ingest the events that have INFO or WARN in them. Can I use the following in the Props.conf without anything in the transforms.conf? And, of course will it work?

[type1-logs]

SEDCMD-removeINFO =s/INFO .+//g

[type2-logs]

SEDCMD-removeWARN =s/WARN .+//g
0 Karma

damann
Communicator

You can use the nullqueue for this purpose:

You need a TRANSFORMS-removeINFO and TRANSFORMS-removeWARN in props.conf:

[type1-logs]
TRANSFORMS-removeINFO = setnullinfo

[type2-logs]
TRANSFORMS-removeWARN = setnullwarn

and in your transforms.conf you need to set the DEST_KEY to queue and FORMAT to nullQueue:

[setnullinfo]
REGEX = INFO\w
DEST_KEY = queue
FORMAT = nullQueue

[setnullwarn]
REGEX = WARN\w
DEST_KEY = queue
FORMAT = nullQueue

Look out for more informations about routing and filtering data in the docs:
https://docs.splunk.com/Documentation/Splunk/7.2.4/Forwarding/Routeandfilterdatad#Filter_event_data_...

0 Karma

nickhills
Ultra Champion

in transforms.conf you need something like this:

[drop_info_warn]
 REGEX = (INFO|WARN)
 DEST_KEY = queue
 FORMAT = nullQueue

then in props.conf you need

[type1-logs]
TRANSFORMS-drop = drop_info_warn

[type2-logs]
TRANSFORMS-drop = drop_info_warn

I am making the assumption that type1-logs, and type2-logs are two different sourcetypes you wish to exclude these events from. If its only one type of log, then you only need to include one such stanza.

To add some context to SEDCMD - this allows you to amend/replace text as the data is indexed, it won't allow you to 'drop' it.
This means that you could mark all the INFO/WARN lines as blank, but you're still going to index them and:
a.) This is almost certainly NOT what you want
b.) You will still be paying to index them (licence usage/disk etc)

By using props AND transforms, you prevent Splunk ever processing (indexing) events which contain these log levels, and I suspect this is what you really want.

If my comment helps, please give it a thumbs up!
0 Karma
Get Updates on the Splunk Community!

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...