Hi,
I have the log file,i need to search the part of line in bold(which as only EmployeeServices/com) and index only that whole line in my index?
How do i write regex to capture only the lines in bold?please help me with props.conf and transform.con
Hi @Ashwini008,
one quick question: is each row a separate event or a part of an event that contains all the rows?
If each row is an event, you can discard the other rows following the steps at https://docs.splunk.com/Documentation/Splunk/8.1.2/Forwarding/Routeandfilterdatad#Keep_specific_even... in few words, you have to configure your props.conf and tranforms.conf on your Indexers or (if present) Heavy Forwarders adding the following rows in an App:
in props.conf
[your_sourcetype]
TRANSFORMS-set= setnull,setparsing
in transforms.conf
[setnull]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue
[setparsing]
REGEX = EmployeeServices\/com\)
DEST_KEY = queue
FORMAT = indexQueue
Ciao.
Giuseppe