How to remove event that contain special characters only

[dantimola]

Hi Splunk Ninjas,

Good Day. Just like to ask on how can I remove event that contain special character only, as sample below.

Thanks.

[somesoni2 · Accepted solution]

Follow the configuration specified in below link:
http://docs.splunk.com/Documentation/Splunk/6.5.2/Forwarding/Routeandfilterdatad#Discard_specific_ev...

On Indexer/Heavy Forwarder
In props.conf, set the TRANSFORMS-null attribute:

[yoursourcetype]
TRANSFORMS-null= setnull

Create a corresponding stanza in transforms.conf. Set DEST_KEY to "queue" and FORMAT to "nullQueue":

[setnull]
REGEX = ^\*+
DEST_KEY = queue
FORMAT = nullQueue

Restart Splunk Enterprise.