How to Use Regex and filter out the GET logs

[anandhalagarasa]

Hi ,

We want to filter the data using REGEX in props.conf and tansforms.conf but still the data is coming into Splunk. We have tried few methods but still logs are reaching splunk so kindly help on this request.

[woodcock]

It is in the documentation here:

http://docs.splunk.com/Documentation/Splunk/6.6.1/Forwarding/Routeandfilterdatad#Filter_event_data_a...

[richgalloway · Accepted solution]

This regex string matches your sample data set. It's hardcoded for the three IP addresses you gave. If the real address is larger, the regex may become unmanageable.

GET\s\/\s-\s80\s-\s10\.228\.(?:9\.1|23\.241|23\.242)

[woodcock]

Do this:
http://docs.splunk.com/Documentation/SplunkCloud/6.6.0/Forwarding/Routeandfilterdatad#Filter_event_d...
If you are doing this, show us your settings.