Getting Data In

What's the best way to filter this sample entry to nullQueue?

agentguerry
Path Finder

Can filters be set up to accomplish this?

Scenario:

4 servers (server001.domain, server002.domain, server003.domain, server004.domain)
on each of those servers is a /var/log/"hostname"a.out and /var/log/"hostname"b.out file

I want to filter out on all 4 servers, in both of the files ("a.out" and "b.out")
ex. var/log/server001a.out and /var/log/server001b.out
/var/log/server002a.out and /var/log/server002b.out

com.site.ws.util.jaxws.SOAPMessageContextUtil - Could not instantiate EfficientStreamMessage java.lang.NoSuchFieldException: envelopeTag

On my Splunk "master" I have:

props.conf

[source::/var/log/server*.out]
TRANSFORMS-null = setnull

transforms.conf

[setnull]
REGEX = (?ism).*java.lang.NoSuchFieldException: envelopeTag.*
DEST_KEY = queue
FORMAT = nullQueue

Restart Splunk.
But the Splunk Web interface still shows them being logged.
Does this syntax/setup look correct?
Can you set a source to be multiple files with a * or wildcards?

0 Karma

yannK
Splunk Employee
Splunk Employee

Beware, the stanza name "setnull" is often used and reused on different apps, so can double check with a btool that this is thew good one applied .

./splunk cmd btool transforms list setnull

I recommend to create your own stanza name, that explains what is does and is unique,
example : [SendJavaExceptionToNullQueue]

woodcock
Esteemed Legend

If your props.conf and transforms.conf are in the same scope as your inputs.conf (i.e. exist inside identical path/directory), this is a correct configuration PROVIDED there are no other stanzas that get processed later that move the same data back out of the nullQueue AND that the files have been distributed to the Indexers and Heavy Forwarders and all Splunk instances there have been restarted.

0 Karma

agentguerry
Path Finder

This is what I had set. Should show 2 asterisks, but the site didn't render it properly

REGEX=(?ism).*java.lang.NoSuchFieldException: envelopeTag.*
0 Karma

musskopf
Builder

Have a look on this link: http://answers.splunk.com/answers/96/how-do-i-exclude-some-events-from-being-indexed-by-splunk.html

Also, are you doing that only on your master? You might need to configure every forwarder.

0 Karma

agentguerry
Path Finder

This would be on the master (server that hosts the indexer, web GUI)

my master inputs.conf file has this and has been pushed to all forwarders.

[monitor:///var/log/*svc*.out]
index = services
source = Services
disabled = 0
sourcetype = ServerOutLogs

From what I understand, to configure every forwarder (the 4 server00x.domain boxes) I need to install a "heavy forwarder" on those. Hoping for a way to do this on the "master"

0 Karma

musskopf
Builder

Another thing.. in your Regexp, you have a "." (dot) at the end... is that really there? You might wanna remove it.

0 Karma

musskopf
Builder

Ok, so if you're running Universal Forwarders it need to be done at Master. Have a look on that link, try to replicate that example and once work adjust for your needs.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...