Getting Data In
Highlighted

How to keep specific events and discard the rest in props.conf and transforms.conf?

Contributor

In splunk doc it is mentioned that**

[[[Note**: In this example, the order of the transforms in props.conf matters. The null queue transform must come first; if it comes later, it will invalidate the previous transform and route all events to the null queue.

In props.conf:

[source::/var/log/messages]
TRANSFORMS-set= setnull,setparsing

2. In transforms.conf:

[setnull]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue

[setparsing]
REGEX = [sshd]
DEST_KEY = queue
FORMAT = indexQueue]]]

why we need to put nullqueue transform first and index queue later? Putting setnull transform first do not delete events before going to setparsing transform?

0 Karma
Highlighted

Re: How to keep specific events and discard the rest in props.conf and transforms.conf?

SplunkTrust
SplunkTrust

The transform on the right side is executed first, so if nullQueue is on right side (executed first), it will dump all data to nullQueue as there is no specific regex.

Highlighted

Re: How to keep specific events and discard the rest in props.conf and transforms.conf?

Esteemed Legend

There are 2 ways to trash events at the indexer:

EITHER:
You can trash the events that match a "drop me" pattern. In this case, simply send the matching events to the nullQueue.
OR:
You can send everything to nullQueue first and then pull back the events that match a "keep me" pattern to the indexQueue.

The last queue location wins.