Send the data to nullqueue except matching event

[RSS_STT]

I want to send the all the event to nullqueue except having match "EventType": 5000.

{"EventID": 2154635, "EventType": 5000, "NetObjectValue": null, "EngineID": null}

[solarwinds:alerts]
TRANSFORMS-t=eliminate-except-5000

[eliminate-except-5000]
REGEX=[\w\W]+[^("EventType": 500)]
DEST_KEY=queue
FORMAT=nullQueue

[richgalloway · Accepted solution]

Regular expressions don't handle negation well.  The given regex will match the sample event because the third character does not consist of "EventType".  It's probably better to index matching events and discard the rest.

[solarwinds:alerts]
TRANSFORMS-t=keep-5000, delete-others


[keep-5000]
REGEX = ("EventType": 5000)
DEST_KEY = queue
FORMAT = indexQueue

[delete-others]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue

[livehybrid]

@richgalloway 

Just a thought, but arent the transforms applied in order, so with keep-5000, delete-others it will set indexQueue if its eventType 5000, and then set nullQueue for everything (incl eventType 5000)? I think the queue can be updated multiple times with props/transforms so might need to be delete-others first so it set queue to nullQueue for everything, and then update to indexQueue for eventType 5000?

I might be wrong and cant find any solid evidence to backup my theory at the mo, other than trying it out which I will do if I get chance!

[PickleRick]

Yes. The transforms are applied

1. Within a single transform class - left to right

2. Separate transform classes are called in alphabetical order.

What is important though (and what is often overlooked by the beginners; guilty of it myself 😉) is that all matching transforms are "fired". It's not like ACL that only first one that matches is executed.

So if you want to do something only for some events, you have to _first_ do the default action (for example, redirect to nullQueue as in this example) and only _then_ update some events to get the special treatment (in this case - get them indexed).

[richgalloway]

You're right, @livehybrid I have the order reversed.  Here's the docs I couldn't find earlier: https://docs.splunk.com/Documentation/Splunk/9.4.1/Forwarding/Routeandfilterdatad#Keep_specific_even...

[isoutamo]

You @livehybrid are correct. It should be 1st send all to nullQueue and then select those events which you want to keep.