Version: 1.0

gajananh999 · ‎09-19-2014

Hello All,

I am working on props.conf and transforms.conf files to clean some data before indexing the data into splunk so i have some data like

Fields: date time cs-method cs-uri sc-status cs-username cs(User-Agent) s-sitename s-ip s-port time-taken cs(Cookie) sc-substatus cs-host cs-version

I want to exclude these lines while indexing data into Splunk. i know we can use blacklist and whitelist to exclude the files in inputs.conf file

Can anyone help me out here.

Thanks

yannK · ‎09-19-2014

Another option is the nullQueue filtering, but has more cost at indextime to parse all the events.

gajananh999 · ‎09-19-2014

Hello Yannk,

nullQueue is not able to remove # lines from file here is the prop
9/17/01 1:02:50.000 AM

Example:

It taking this whole thing as one event

Thanks
Gajanan Hiroji

martin_mueller · ‎09-19-2014

Are you trying to ignore the preamble of a log file? If so, give PREAMBLE_REGEX in props.conf a shot. See http://docs.splunk.com/Documentation/Splunk/6.1.3/Data/Extractfieldsfromfileheadersatindextime#Props... for documentation.

martin_mueller · ‎09-19-2014

That should do it.

gajananh999 · ‎09-19-2014

Hello Martin,

will this work to remove lines from file which are starts with #?

PREAMBLE_REGEX=^#

Thanks
Gajanan HIroji