Getting Data In

How to drop event comming from host template*

ktn01
Path Finder

Hello,
I have to drop all events received from hosts named template*

I have created an app on indexer with the following files:

local/app.conf

[install]
is_configured = 1

[ui]
is_visible = 0
label = NoTemplate

[launcher]
author = moi
description = ignore les events qui proviennent des hosts template*
version = 0.0

local/props.conf

[host::template...]
TRANSFORMS-template = drop_templates

local/transforms.conf

[drop_templates]
REGEX = .
DEST_KEY=queue
FORMAT=nullQueue

Events from host template-rh-7tstill indexed !?

I also try with stanza host::template*]

Any idee ?

Thanks
Christian

Tags (2)
0 Karma

FritzWittwer_ol
Contributor

your pattern in the props stanza name
[host::template...]
matches hostnames 'template' followed by exactly 3 more arbitrary chars.

You should use something like
[host::template.*]
this matches template followed by an arbitrary number of arbitrary chars. Just be careful, this matches anything which starts with template.

0 Karma
Get Updates on the Splunk Community!

Enhance Your Splunk App Development: New Tools & Support

UCC FrameworkAdd-on Builder has been around for quite some time. It helps build Splunk apps faster, but it ...

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...