How to exclude string from being indexed?

[mmsbswe]

Hello community,

i want to configure the splunk forwarder to exclude one specific string from being indexed to the splunk index.

In my case i want to exclude all lines like this from being transferred to the indexer:

*[25-Jun-2019 15:31:29 Europe/Berlin] PHP Deprecated:  The "checkDataSubmission" hook will be removed...*

These are my config files:

File: **/opt/splunkforwarder/etc/system/local/inputs.conf**

...
[monitor:///var/log/docker/php-fpm/error.log]
sourcetype=php:fpm:error
crcSalt=
index=php


File: **/opt/splunkforwarder/etc/system/local/props.conf**

[source::/var/log/docker/php-fpm/error.log]
TRANSFORMS-null= setnull


File: **/opt/splunkforwarder/etc/system/local/transforms.conf **

[setnull]
REGEX = .*PHP Deprecated.*
DEST_KEY = queue
FORMAT = nullQueue

I've done the following steps to debug this by myself:
executed:

- *./splunk cmd btool props list --debug*
- *./splunk cmd btool transforms list --debug*

To check if my configuration files was loaded when restarting the splunk service. All my configured lines are displayed by this.

Also i've restarted the splunk forwarder after editing the config.

Every help will be appreciated.

[amitm05 · Accepted solution]

@mmsbswe
Looks like you are trying to do this on the Univ forwarder itself. These would not apply on UF.
You'd require to take these settings of props.conf and transforms.conf onto your indexer.

Thanks!

[amitm05]

Have you tried this? Let us know.
You can also mention if you have already sorted this out OR Accept this one if it worked. It'll help others. Thanks

[mmsbswe]

Thanks for your reply.

Correct, i do this on the universial forwarder. It seems that i have to try it on our indexer.

Edit: Now it works :-).

[amitm05]

Glad that it worked out. Cheers !