Hi Experts,
I am getting logs / events from an application server to an indexer. I want to index logs with the string "connected to machine" and drop rest all events.
Please help me with props.conf and transforms.conf file syntax.
Trying to implement this myself... struggling. Reading the link woodcock supplied now.
Look here:
In props.conf:
[YourSourceOrSourceTypeHere]
TRANSFORMS-set= setnull,setparsing
In transforms.conf:
[setnull]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue
[setparsing]
REGEX = connected\sto\smachine
DEST_KEY = queue
FORMAT = indexQueue
Deploy to Indexers and restart all splunk instances there. This will apply ONLY to events indexed after the restart.
Thanks for response.
I my case I have two index and different source. So I want to forward logs to index logs in specifix indexer.
I tried below option but all logs get filtered.
[setnull]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue
[setparsing]
REGEX = connected\sto\smachine
DEST_KEY = queue
FORMAT = myindexname
It does not work that way. You set the destination index
( myindexname
) in inputs.conf
. You must use FORMAT = indexQueue
to pull it back out of the nullQueue.