How to Ingest Splunk Lines starting with

[whitefang1726]

Hello, how can I ingest logs starting with a specific word:

Sample Log Entry:
SPLUNKD-123456: Hello World
Hello World123
Hello World456
Hello World789
SPLUNKD-0000: Hello World
SPLUNKD-0012: Hello World
Hello World0123
Hello World0456

Logs that will be ingested into Splunk:

SPLUNKD-123456: Hello World
SPLUNKD-0000: Hello World
SPLUNKD-0012: Hello World

Thanks!

[gcusello]

Hi @whitefang1726,

let me understand: do you want to filter log before indexing and index only a subseto of events or do you want to index alla events and display in search only filtered events?

If you want to take only events that start with "SLUNKD" , you should see at https://docs.splunk.com/Documentation/Splunk/8.2.4/Forwarding/Routeandfilterdatad#Filter_event_data_... and put in your indexers or (if present) in your Heavy Forwarders the following conf files:

in props.conf:

[your_sourcetype]
TRANSFORMS-set= setnull,setparsing

in transforms.conf:

[setnull]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue

[setparsing]
REGEX = ^SPLUNKD
DEST_KEY = queue
FORMAT = indexQueue

In the second case, you index all events and in your search you could run something liker this:

index=your_index sourcetype=your_sourcetype SPLUNKD
| ...

Ciao.

Giuseppe

[PickleRick]

Filtering on ingest is one way (relatively universal but adding load to your indexers/heavy forwarders). You can also try to prevent the entries from being picked up by the input but how to do that is highly dependent on where you have your events and how you are receiving/pulling them.