Getting Data In

How to configure props.conf and transforms.conf to index logs with a specific string and filter out all other events?

chanduira
Explorer

Hi Experts,

I am getting logs / events from an application server to an indexer. I want to index logs with the string "connected to machine" and drop rest all events.

Please help me with props.conf and transforms.conf file syntax.

0 Karma

joesrepsolc
Communicator

Trying to implement this myself... struggling. Reading the link woodcock supplied now.

0 Karma

woodcock
Esteemed Legend

Look here:

http://docs.splunk.com/Documentation/Splunk/6.3.1/Forwarding/Routeandfilterdatad#Keep_specific_event...

In props.conf:

[YourSourceOrSourceTypeHere]
TRANSFORMS-set= setnull,setparsing

In transforms.conf:

[setnull]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue

[setparsing]
REGEX = connected\sto\smachine
DEST_KEY = queue
FORMAT = indexQueue

Deploy to Indexers and restart all splunk instances there. This will apply ONLY to events indexed after the restart.

0 Karma

chanduira
Explorer

Thanks for response.
I my case I have two index and different source. So I want to forward logs to index logs in specifix indexer.

I tried below option but all logs get filtered.

[setnull]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue
[setparsing]
REGEX = connected\sto\smachine
DEST_KEY = queue
FORMAT = myindexname
0 Karma

woodcock
Esteemed Legend

It does not work that way. You set the destination index ( myindexname ) in inputs.conf. You must use FORMAT = indexQueue to pull it back out of the nullQueue.

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...