Getting Data In

Need help filtering at the indexer

pipegrep
Path Finder

We have a service account that populates /var/log/messages on many systems with 3 lines of text every 5 minutes. I'd like to filter that out.

These entries come in on a single source: /var/log/messages
...and a single source type: syslog

We have 4 indexers that are fed by 12 universal forwarders (in turn fed by many other Windows and linux hosts).

I'm using a deployment server to successfully deploy props.conf and transforms.conf to each of the indexers.

This is my entry in props.conf;

[syslog]
TRANSFORMS-set = setnull

This is my entry in transfro

[setnull]
REGEX = svc_scomlinux
DEST_KEY = queue
FORMAT = nullQueue

I expect any entries coming in on the source/sourcetype and containing the text svc_scomlinux to be discarded, but it's still coming through.

I spent a good part of the day reading answers here, docs and other sources on the web but I'm not getting any traction. What am I missing?

Thanks

Tags (3)
0 Karma
1 Solution

pipegrep
Path Finder

It indeed was something silly. Ultimately I found that my search heads were actually running heavy forwarders and were outside of my deployment changes, subsequently spewing out the events. Thanks.

View solution in original post

0 Karma

pipegrep
Path Finder

It indeed was something silly. Ultimately I found that my search heads were actually running heavy forwarders and were outside of my deployment changes, subsequently spewing out the events. Thanks.

0 Karma

woodcock
Esteemed Legend

This looks correct to me, unless you have misspelled transforms.conf or something silly like that. Are you getting any errors when you start Splunk saying that it cannot find setnull? You should use btool to check out what configurations are actually in place.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...