Splunk Search

Index time extraction

bhavneeshvohra9
New Member

Hi all,
I have 10 events containing events from events 1,event2,event 3,....event 10.
I need to cobine events2,3,4 and events 7,8 into one event each i.e one event for 2,3,4 and one event for 7,8.
Rest all i dont need to index(send to null queque)
How can we do this on index time.

Please help

Tags (1)
0 Karma

woodcock
Esteemed Legend

Like this:

SHOULD_LINEMERGE = false
LINE_BREAKER = ((?:^event1RegExHere[\r\n]+)|(?:event5RegExHere[\r\n]+event6RegExHere[\r\n]+)|(?:event9RegExHere[\r\n]+event10RegExHere[\r\n]*$))
0 Karma

to4kawa
Ultra Champion

porps.conf

should_linemerge = false
line_breaker = ([\r\n]+)event5
transforms-null = null

transforms.conf

[null]
REGEX = [event1|event5|event6|event9|event10]
DEST_KEY = queue
FORMAT = nullQueue
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...