We have a system where at times the engineers running it need to enable debug output. This naturally kills the splunk license easily :-).
I currently use something like this on the indexer but it uses lots of resources at times so i would like to do it with a sedcmd on the sending machine.
transforms.conf
[setnull]
REGEX = .+-DBG_.+
DEST_KEY = queue
FORMAT = nullQueue
So the pattern is rather easy 🙂 but how can i use SEDCMD to skip lines matching the pattern from being sent to the indexer?
You need to reinstall your forwarder as a heavy forwarder
and then do one of the to "delete some and forward the rest" options in the link below. Do note what it says about using SEDCMD
(it does not support the delete
capabilitybut you can use the
replace` capability to swap with "nothing"):
http://answers.splunk.com/answers/122830/filtering-fields-in-log-before-forward-to-indexing.html
This page may also help:
http://docs.splunk.com/Documentation/Splunk/6.2.3/Data/Anonymizedatausingconfigurationfiles