Splunk Search

How and where do I filter logs with regex before indexing?

SridharS
Path Finder

I have a .txt log file and it has many patterns in it. I need logs of only a particular pattern. How and where can I filter them using regex?

Tags (3)
0 Karma

MuS
SplunkTrust
SplunkTrust

Hi SridharS,

read the docs http://docs.splunk.com/Documentation/Splunk/6.3.1511/Forwarding/Routeandfilterdatad#Filter_event_dat... about Filter event data and send to queues where you can learn how this can be done. You have to do this either on the indexer or a heavy weight forwarder - don't forget to restart Splunk after the changes and it will only apply to new events.

Hope this helps ...

cheers, MuS

0 Karma
Get Updates on the Splunk Community!

Should our Deployment Servers have the Search Head server role on them?

all of our stuff is on premcurrently our dedicated Deployment Servers also have the Search Head role on them, ...

Why am I unable to create dropdown static option that is "All" static options ...

Hi, I am trying to get a static option that is "All" the individual static options combined.  The mCode ...

Where can we set the script (host=CSG196) so can we deploy the script in host?

Hi  We face a challenge We have created one alert in which we are monitoring one of the windows service ...