Splunk Search

Discard specific events (Debug) and keep the rest

nikhilagrawal
Path Finder

Hi
I want to discard all log which includes "DEBUG" and want to receive only with "INFO and ERROR". I am receiving hell lot of those logs and indexer is swamped with them. The Pattern of the log file as follows:

DEBUG 2012-08-08 09:56:44,111 [DistributedCacheWorker:22] process- [] Heatbeat for instance 1 of service System X Even.host=lonrs06087 Options| sourcetype=sfx-application source=/opt/datasynapse/DSEngine/work/l.log Options

Solution tried: I have tried to solution provided on: http://docs.splunk.com/Documentation/Splunk/4.3/Deploy/Routeandfilterdatad#Discard_specific_events_a...

So Under props.conf :

[source::.../coherence-*.log]
TRANSFORMS-null= setnull

And transform.conf:

[setnull]
REGEX = \\DEBUG
DEST_KEY = queue
FORMAT = nullQueue

But its not seems to be working.
can anybody help me with this please?
Thanks/

Tags (1)
0 Karma

Jason
Motivator

You need to make sure your REGEX is set properly. \\DEBUG, looks for a literal backslash followed by the word DEBUG. I would suggest ^DEBUG (find DEBUG at the beginning of the raw text).

Also, make sure this is on the first indexer or heavy forwarder the data encounters, and that your transforms.conf is transforms.conf, not transform.conf.

When putting code into SplunkBase, use backticks (`) to denote sections of code - I couldn't see the double slash at first.

nikhilagrawal
Path Finder

Thanks it worked.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...