How do i index only specific lines from my log file?

[Ashwini008]

Hi,

I have the  log file,i need to search the part of line in bold(which as only EmployeeServices/com) and index only that whole line in my index?

How do i write regex to capture only the lines in bold?please help me with props.conf and transform.con

[gcusello]

Hi @Ashwini008,

one quick question: is each row a separate event or a part of an event that contains all the rows?

If each row is an event, you can discard the other rows following the steps at https://docs.splunk.com/Documentation/Splunk/8.1.2/Forwarding/Routeandfilterdatad#Keep_specific_even... in few words, you have to configure your props.conf and tranforms.conf on your Indexers or (if present) Heavy Forwarders adding the following rows in an App:

in props.conf

[your_sourcetype]
TRANSFORMS-set= setnull,setparsing

in transforms.conf

[setnull]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue

[setparsing]
REGEX = EmployeeServices\/com\)
DEST_KEY = queue
FORMAT = indexQueue

Ciao.

Giuseppe