Getting Data In
Provide Splunk Cloud feedback in this confidential UX survey by June 17
for a chance to win a $200 Amazon gift card!

Issues sending filtered data to specific index

bms9nmh
New Member

I have an index named myindex.

I'm trying to filter out lines that contain CRON entries in the auth.log, and send them to myindex. I'm using a negative regex search so any line that doesn't contain CRON matches, and therefore appear in myindex. I'm using the following transforms.config and props.config files.

transforms.conf

[filter_out_cron]
  REGEX=^(?!.*CRON\[.*?\]:).*$
  DEST_KEY=_MetaData:Index
  FORMAT=myindex

props.conf

[source::/var/log/auth.log]
  TRANSFORMS-indexRouting=filter_out_cron

The auth.log lines with CRON entries are still appearing, but I can't tell why. Does this look like a configuration that should work?

0 Karma

woodcock
Esteemed Legend

Your settings are correct so it must be something else. If you are doing a sourcetype override/overwrite, you must use the ORIGINAL value, NOT the new value. You must deploy your settings to the first full instance(s) of Splunk that handle the events (usually either the HF tier if you use one, or else your Indexer tier), restart all Splunk instances there, send in new events (old events will stay broken), then test using _index_earliest=-5m to be absolutely certain that you are only examining the newly indexed events.

0 Karma

bms9nmh
New Member

Hey woodcock, thanks for the response. I'm not sure I understand the bit about sourcetype override, could you give me an example?

0 Karma

woodcock
Esteemed Legend

If you are the admin for Splunk, you would know if you were doing sourcetype-override; in any case:
https://docs.splunk.com/Documentation/Splunk/latest/Data/Advancedsourcetypeoverrides

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!