Splunk Search

How to drop all events that start with DEBUG at the HF?

Glasses
Builder

Hi, 

I'm having no luck getting a filter-n-drop setup... 

I referenced  https://docs.splunk.com/Documentation/Splunk/8.2.5/Forwarding/Routeandfilterdatad

Discard specific events and keep the rest

 

props.conf
[source::/opt/fooBar/*]
TRANSFORMS-null = setnull

transforms.conf
[setnull]
REGEX =  ^(DEBUG)
DEST_KEY = queue
FORMAT = nullQueue

 

 

I am not sure if the REGEX is correct, but "debug" is seen in ERROR events so I only want to capture and drop events where DEBUG is the first word...  

Any help appreciated.

Thank you!

Labels (3)
0 Karma
1 Solution

PickleRick
Ultra Champion

You don't need to capture the DEBUG word so regex of ^DEBUG would be sufficient.

But just for testing, remove the beginning of the line anchor, leave just DEBUG and check if it's working. It should match the word DEBUG anywhere in the event so if it doesn't work, the transform is not being applied.

Did you check the effective props and transforms with btool to check if it's not overwritten anywhere?

View solution in original post

0 Karma

somesoni2
Revered Legend

Is log level (DEBUG|INFO|ERROR etc) the first word in the raw event?

0 Karma

Glasses
Builder

yes, show source shows DEBUG .... <rest of the line data>

0 Karma

somesoni2
Revered Legend

Did you applied the configuration on Heavy forwarder (if you use one) OR indexer (if data directly comes from UF to indexer) ? Did you restart Splunk after applying change?

0 Karma

Glasses
Builder

yes we did apply the confs on the HF, and yes we did restart

0 Karma

Glasses
Builder

the events are sourcetype=catalina,

should I try using this combo under

[catalina]   ?

or do you think the regex is bad? 

maybe there is something hidden in the raw... 

REGEX = *DEBUG* ?

IDK

0 Karma

PickleRick
Ultra Champion

You don't need to capture the DEBUG word so regex of ^DEBUG would be sufficient.

But just for testing, remove the beginning of the line anchor, leave just DEBUG and check if it's working. It should match the word DEBUG anywhere in the event so if it doesn't work, the transform is not being applied.

Did you check the effective props and transforms with btool to check if it's not overwritten anywhere?

0 Karma

Glasses
Builder

We tried your suggestions but still no luck.

We will poke around with btool to find the issue.

Thankyou

0 Karma

Glasses
Builder

Thank you, we found the issue.

Your suggestions were helpful.

0 Karma