Getting Data In

Send the logs level info to null queue

abhi04
Communicator

Hi, I am trying to ignore the logs that have level info and want to send them to null queue:

example logs (not including the befor eand after pattern of the logs but its a json format and this is one of the fields): 

"level":"info",

 

I have tried below and it does not work, can someone help if this is correct or is there another way, the below is in heavy forwarder

props:

[abc]
TRANSFORMS-null = infonull

 

transforms

[infonull]
SOURCE_KEY = level
REGEX = info
DEST_KEY = queue
FORMAT = nullQueue

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

"level" is not a valid value for SOURCE_KEY.  Try _raw, instead.

[infonull]
SOURCE_KEY = _raw
REGEX = "level":"info"
DEST_KEY = queue
FORMAT = nullQueue
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

abhi04
Communicator

Thanks @richgalloway 

richgalloway
SplunkTrust
SplunkTrust

"level" is not a valid value for SOURCE_KEY.  Try _raw, instead.

[infonull]
SOURCE_KEY = _raw
REGEX = "level":"info"
DEST_KEY = queue
FORMAT = nullQueue
---
If this reply helps you, Karma would be appreciated.
0 Karma

abhi04
Communicator

Sample example logs:

{"timestamp":"2023-12-12T15:27:22.890Z","shortmessage":"(abc): def ghi","level":"info","source":"xyz,"file":"/home/abc/def.txt","line":144}

0 Karma
Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Building Momentum: Splunk Developer Program at .conf25

At Splunk, developers are at the heart of innovation. That’s why this year at .conf25, we officially launched ...