processing only certain hosts from a file

[a212830]

Hi,

I have a logfile with a bunch of hosts, but I only want to index certain hosts and throw the rest away. How would I do this?

[Ayn · Accepted solution]

Create a regex that matches the hosts you want to index data from and send the rest of the events to the nullQueue. http://docs.splunk.com/Documentation/Splunk/5.0.1/Deploy/Routeandfilterdatad#Keep_specific_events_an...

[a212830]

Never mind - brain fart! All set.

[okrabbe_splunk]

Is the [source] stanza actually inputs.conf or did you put it in props.conf?

[a212830]

I tried following the doc, and I keep getting a possible typo error. I can't find the problem.

inputs.conf:

[monitor:///usr/local/nsmutils/varlog/ncosyslog.log]
disabled = false
followTail = 0
index= throwaway
sourcetype = euc_syslogdata

[source::/usr/local/nsmutils/varlog/ncosyslog.log]
TRANSFORMS-set=setnull,setparsing

transforms.conf:
[setnull]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue

[setparsing]
REGEX = [vc-]
DEST_KEY = queue
FORMAT = indexQueue

[a212830]

Exactly what I'm looking for! Thanks.