How to filter out data after specific event?

[haph]

Hi,

I'm trying to filter out data after a specific event occurs.

I want to drop all of the search data to display in a timechart, after a this specific event.
The event (and all other data) is in the shape
{
"name": "NAME",
"value": "VALUE"
}

If the value from name=specific_name changes from 0 to 1 I want to drop all data after this change.

How can I do that?

If you need more information please ask! 🙂

Thanks!

[sbattista09]

i think this answer may help, its should be a quick props.conf and transforms.conf setting, we do this to filter out huge debug logs and other things application owners cant adjust on there side.

https://answers.splunk.com/answers/223818/how-to-write-the-regex-in-transformsconf-to-filter.html

[somesoni2]

More information plz. Assuming this NOT filtering of events from being ingested but rather doing a search time filter in your search. Please provide details about how your data looks (may be real data), what you're getting now and what you expect.