Need to parse or eliminate -----------------------------------------------------------------

[VijaySrrie]

Hi,

Out of 100 logs one of my log is --------------------------------------------------------
How to parse or eliminate this?

[to4kawa]

set LINE_BREAKER= (--{40}) in _props.conf

[VijaySrrie]

Hi All,

Below one worked:

I created transforms.conf
transforms.conf
[setnull]
REGEX = -+
DEST_KEY = queue
FORMAT = nullQueue

In props.conf added the line
TRANSFORMS-null = setnull

[efavreau · Accepted solution]

Hi @vijaysri! There are some options I have outlined below. There may be more. It starts with your admins and ends with what I would try first.
1. If this is a log source, you can remove it by changing the source in your SPL to: source!=mydashedlinelogsource This will ignore that log source. Although if this is the case, you might want your admins to stop ingesting that log file. I will assume it's not a log source for the other options.
2. If you want to give this line a name, so you can exclude it later in your search, you could use a regular expression to capture it and a search to filter it out. This isn't a great approach, because it's inefficient, but it works. This assumes the dashed line is of the same known length. Test it to make sure you aren't excluding other useful files.
| rex field=_raw (?<DashedLineLog>(--------------------------------------------------------)) | search DashedLineLog!=*
3. There's another option besides writing the regular expression yourself. You can use the Field Extractor, which would work very well for this scenario: https://docs.splunk.com/Documentation/Splunk/Latest/Knowledge/ExtractfieldsinteractivelywithIFX
4. However, if you know the dashed line is of the same known length every time, because it's an entire log event, or there's nothing else in the log event that you care about, you could before the first pipe ( | ) in your search query , put in NOT "--------------------------------------------------------", and this will eliminate those log events containing that string. Test it to make sure you aren't excluding other useful files. This would be my first approach, because anything you can put before the first pipe will improve search performance.

Good luck!

[VijaySrrie]

Hi All,

Below one worked:

I created transforms.conf
transforms.conf
[setnull]
REGEX = -+
DEST_KEY = queue
FORMAT = nullQueue

In props.conf added the line
TRANSFORMS-null = setnull

[gcusello]

Hi @vijaysri,
if you can find a regex to parse this event it's possible to eliminate it.
Can you share an example of your logs?

Ciao.
Giuseppe