event filtering using transforms and props

[ajaysamantbms]

My event data contains the foll

POST:....
...
ffffff
ABCD
EFG

WERT
SDF
... and so on

As you see some lines are non-xml and some are xml..

my props.conf file has right set of rules

[sourcetype]
BREAK_ONLY_BEFORE = ||
KV_MODE = xml
NO_BINARY_CHECK = 1
SHOULD_LINEMERGE = true
pulldown_type = 1
TRANSFORMS-set = setnull, setparsing

and in transforms.xml

[setnull]
REGEX= .
DEST_KEY = queue
FORMAT = nullQueue

[setparsing]
REGEX = ||
DEST_KEY = queue
FORMAT = indexQueue

Will this work? ...the lines outside XML tags as shown in example should not be indexed...

[kristian_kolb]

Er, well, no. Your events will be broken where you've indicated, i.e. like this;

Event 1:

<transaction>ffffff</transaction> 
ABCD EFG 

Event 2:

<access></access> 
WERT SDF

Thus you should consider whether these are the types of event that you want. Btw, do they even contain timestamps?

As for the second part of your setup, the nullQueueing will work, but maybe not as you've expected. The ordering of the transforms is correct - all events (the regex dot) get queue=nullQueue in the first transform, but since all events (at least according to your sample events) will also match on the second transform, they get the queue set back to indexQueue. In short, the order of the transforms matters since each event for your sourcetype will pass through all transforms - in order - before being processed further.

If you want to filter out parts of an event, you should probably look at some other options, like SEDCMD. Perhaps this can be of use;

http://docs.splunk.com/Documentation/Splunk/6.0.1/Data/Anonymizedatausingconfigurationfiles

Hope this helps,

K