Getting Data In

Ingest Action to include message

yuvaraj_m91
Loves-to-Learn Lots

I am using ingest action to filter the log message before being indexed in splunk..

I want to include the message that matches only the keyword :ERROR: and :FATAL: rest all of the messages should not be indexed.

Whereas in splunk ingest action has the filter to only exclude message not the include

Labels (1)
Tags (1)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

If you're not hellbent of doing it with Ingest Actions, you can just use transforms to filter out all events except for the ones you want

https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad

In your case you'd need to first have a "match-all" transform rerouting all data to nullQueue, and then a transform maching only ERROR/FATAL events sending the events to indexQueue.

yuvaraj_m91
Loves-to-Learn Lots

we are using splunk cloud UI

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Doesn't matter. You can make an app with those settings and deploy it to your Cloud instance.

0 Karma

deepakc
Builder

Hi 

You might then be able to apply a regex pattern to say to NOT not match ERROR or FATAL, therefore keep them, and discard the rest. 

Try this 
^(?!.*(ERROR|FATAL)).*$

0 Karma

yuvaraj_m91
Loves-to-Learn Lots

I tried this but still i am seeing other events being ingested apart from :ERROR: and :FATAL:

0 Karma

deepakc
Builder

Suggestions made by @PickleRick  are probably best to go with. 

In terms of it still not working - you will most likely need to adjust the reg-ex pattern based on your logs.

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...