Getting Data In

Try to use transforms.conf

Hula
New Member

Hi,

we try around with Splunk (first contact). We to prof what we can log from HDS Storages.

System report via Port 11101 UDP:

As an example what we dont need.
"Jan 18 11:44:23 SYSXX Jan 18 11:44:27 SVP Storage: CELFSS,1.1,410713,,2017-01-18T11:44:27.1+01:00,Storage,SVP,Authentication,Success,uid=lalalal({COMPONENT-POLLER}:DvM_Srv),R800:XXXXX,,SYSXX_Auditlog,,,,from=10.135.XXX.XXX,,,,384397,BasicLog,,,RMI AP,167,,[BASE],Logout,,Normal end,Seq.=0000384397"

these messages are coming (varies) in 1-5 minutes with similia content. All what we get with "POLLER" shoudl be not sorted in...ist useless for us.

Copy props.conf to *system/local and add at the end:
[source::udp:11101]
TRANSFORMS-null= setnull

copy transforms and add at the end.
[setnull]
REGEX = [/POLLER]
DEST_KEY = queue
FORMAT = nullQueue

But that did not work. All of the messages are coming in. I guess i made a failure in REGEX or in Brain 1.0...not sure.
where is my fault?

regards

0 Karma

Richfez
SplunkTrust
SplunkTrust

Hula, you made me laugh this morning. "... a failure in REGEX or in Brain 1.0". Thank you for that.

BTW, try REGEX=POLLER

I'm assuming that the word "POLLER" won't be found in any event you want to keep? Here's the regex101 you can use to confirm it works.

https://regex101.com/r/Dtydhe/1

0 Karma

Hula
New Member

Will try this line.
REGEX = POLLER

Thx...have to wait i little while.

0 Karma

Hula
New Member

Hmmm, did not work. Sry, im realy a beginner.

[setnull]
REGEX = POLLER
DEST_KEY = queue
FORMAT = nullQueue
0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!