How to Use Regex and stop the logs reaching Splunk in this Scenario

[anandhalagarasa]

Hi ,

We want to filter the following data using REGEX in props.conf and tansforms.conf but still the data is coming into Splunk. We have tried few methods but still logs are reaching splunk so kindly help on this request.

[DalJeanis]

So which way do you want the decision made? Pick one -

A) Kill anything that starts with GET
B) Keep anything that starts with POST
C) Keep anything that has Java/* in that position.

[skoelpin · Accepted solution]

Put this in your transforms.conf

[GET-to-nullQueue]
 REGEX=\d+\s\-\s-\s\d{3}
 DEST_KEY=queue
 FORMAT=nullQueue

Place this in your props.conf

[YOUR_Sourcetype]
 TRANSFORMS-t1=GET-to-nullQueue

Restart your Splunkd service for the changes to take affect.. This will not work retroactively, this will only work on new events coming in

[horsefez]

skoelpins regex is right, but you could also use this visually more pleasing one
REGEX=(?=(?>\s\-\s\-\s))

just sayin :3

[inventsekar]

Hi Anand, please update us your current props.conf, so that we can understand your current configuration and suggest.