filtering out data without a timestamp

[a212830]

Hi,

I have some logfiles that include data that I don't want - the lines don't have timestamps, and begin with either a comment (<!--) or a stylesheet statement (<xsl...). Is there a way filter this stuff out?

[yannK]

You can do index time nullQueue filtering based on a regex, it has to be setup at the indexer level.
But be aware that if you apply that rule to all your events, it may have performance impact.

http://docs.splunk.com/Documentation/Splunk/5.0.2/Deploy/Routeandfilterdatad#Discard_specific_events...