How to use SEDCMD to skip whole lines matching a regex pattern from being indexed?

[dominiquevocat]

We have a system where at times the engineers running it need to enable debug output. This naturally kills the splunk license easily :-).

I currently use something like this on the indexer but it uses lots of resources at times so i would like to do it with a sedcmd on the sending machine.

transforms.conf
[setnull]
REGEX = .+-DBG_.+
DEST_KEY = queue
FORMAT = nullQueue

So the pattern is rather easy 🙂 but how can i use SEDCMD to skip lines matching the pattern from being sent to the indexer?

[woodcock]

You need to reinstall your forwarder as a heavy forwarder and then do one of the to "delete some and forward the rest" options in the link below. Do note what it says about using SEDCMD (it does not support the delete capabilitybut you can use thereplace` capability to swap with "nothing"):

http://answers.splunk.com/answers/122830/filtering-fields-in-log-before-forward-to-indexing.html

This page may also help:

http://docs.splunk.com/Documentation/Splunk/6.2.3/Data/Anonymizedatausingconfigurationfiles