Discard specific events (Debug) and keep the rest

[nikhilagrawal]

Hi
I want to discard all log which includes "DEBUG" and want to receive only with "INFO and ERROR". I am receiving hell lot of those logs and indexer is swamped with them. The Pattern of the log file as follows:

DEBUG 2012-08-08 09:56:44,111 [DistributedCacheWorker:22] process- [] Heatbeat for instance 1 of service System X Even.host=lonrs06087 Options| sourcetype=sfx-application source=/opt/datasynapse/DSEngine/work/l.log Options

Solution tried: I have tried to solution provided on: http://docs.splunk.com/Documentation/Splunk/4.3/Deploy/Routeandfilterdatad#Discard_specific_events_a...

So Under props.conf :

[source::.../coherence-*.log]
TRANSFORMS-null= setnull

And transform.conf:

[setnull]
REGEX = \\DEBUG
DEST_KEY = queue
FORMAT = nullQueue

But its not seems to be working.
can anybody help me with this please?
Thanks/

[Jason]

You need to make sure your REGEX is set properly. \\DEBUG, looks for a literal backslash followed by the word DEBUG. I would suggest ^DEBUG (find DEBUG at the beginning of the raw text).

Also, make sure this is on the first indexer or heavy forwarder the data encounters, and that your transforms.conf is transforms.conf, not transform.conf.

When putting code into SplunkBase, use backticks (`) to denote sections of code - I couldn't see the double slash at first.

[nikhilagrawal]

Thanks it worked.