Splunk Search

How to use regex to exclude events containing "session-6-305012" before indexing?

kiran331
Builder

How to use regex to exclude events containing "session-6-305012" before indexing?

sample event:

1.2.3.4 :Jul 06 20:12:40 UTC: %ASA-session-6-305012: Teardown dynamic TCP translation from inside:1.2.33.55/10447 to outside:22.33.44.55/29479 duration 0:00:30
0 Karma
1 Solution

somesoni2
Revered Legend

You need to follow instruction from below documentation. Just update REGEX per yours.

http://docs.splunk.com/Documentation/Splunk/6.5.2/Forwarding/Routeandfilterdatad#Discard_specific_ev...

REGEX = session-6-305012

View solution in original post

0 Karma

somesoni2
Revered Legend

You need to follow instruction from below documentation. Just update REGEX per yours.

http://docs.splunk.com/Documentation/Splunk/6.5.2/Forwarding/Routeandfilterdatad#Discard_specific_ev...

REGEX = session-6-305012
0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...