Getting Data In

How to exclude string from being indexed?

mmsbswe
Engager

Hello community,

i want to configure the splunk forwarder to exclude one specific string from being indexed to the splunk index.

In my case i want to exclude all lines like this from being transferred to the indexer:

*[25-Jun-2019 15:31:29 Europe/Berlin] PHP Deprecated:  The "checkDataSubmission" hook will be removed...*

These are my config files:

File: **/opt/splunkforwarder/etc/system/local/inputs.conf**

...
[monitor:///var/log/docker/php-fpm/error.log]
sourcetype=php:fpm:error
crcSalt=
index=php


File: **/opt/splunkforwarder/etc/system/local/props.conf**

[source::/var/log/docker/php-fpm/error.log]
TRANSFORMS-null= setnull


File: **/opt/splunkforwarder/etc/system/local/transforms.conf **

[setnull]
REGEX = .*PHP Deprecated.*
DEST_KEY = queue
FORMAT = nullQueue

I've done the following steps to debug this by myself:
executed:

- *./splunk cmd btool props list --debug*
- *./splunk cmd btool transforms list --debug*

To check if my configuration files was loaded when restarting the splunk service. All my configured lines are displayed by this.

Also i've restarted the splunk forwarder after editing the config.

Every help will be appreciated.

0 Karma
1 Solution

amitm05
Builder

@mmsbswe
Looks like you are trying to do this on the Univ forwarder itself. These would not apply on UF.
You'd require to take these settings of props.conf and transforms.conf onto your indexer.

Thanks!

View solution in original post

0 Karma

amitm05
Builder

@mmsbswe
Looks like you are trying to do this on the Univ forwarder itself. These would not apply on UF.
You'd require to take these settings of props.conf and transforms.conf onto your indexer.

Thanks!

0 Karma

amitm05
Builder

Have you tried this? Let us know.
You can also mention if you have already sorted this out OR Accept this one if it worked. It'll help others. Thanks

0 Karma

mmsbswe
Engager

Thanks for your reply.

Correct, i do this on the universial forwarder. It seems that i have to try it on our indexer.

Edit: Now it works :-).

0 Karma

amitm05
Builder

Glad that it worked out. Cheers !

0 Karma
Get Updates on the Splunk Community!

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

SignalFlow: What? Why? How?

What is SignalFlow? Splunk Observability Cloud’s analytics engine, SignalFlow, opens up a world of in-depth ...

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...