Splunk Search

Need to omit events with specific strings (info or debug) in them.

Arpit_S
Path Finder

I am trying to prevent debug and info events from getting logged into splunk. I created an inputs.conf and used blacklist statement to blacklist these events, but it didn't help.

I wrote below stanza in inputs.conf using regex, but no luck.

blacklist = .:\s+[(debug|\sinfo)|.

Can i directly do blacklisting in inputs.conf using the below statements?
blacklist1 = debug
blacklist2 = info

If not how can I do it? Is the only option left is using props.conf and transforms.conf and sending these events to nullqueue?

Please help!

Regards,
Arpit

Tags (1)
0 Karma

lacastillo
Path Finder

In order to remove events at index time use SEDCMD in props.conf

ex:
[your_custom_sourcetype]
SEDCMD-remove = s/(place_regex_that_matches_events_you_wish_to_remove_here)//g

Let me know if that helps.

0 Karma

sudosplunk
Motivator

Hello,

If 'INFO' and 'DEBUG' events are in the same log file along with other data(you want to ingest), then yes, using props.conf and transforms.conf is the only way. Using blacklist in inputs.conf will only look for the keywords in the name of the source-file not inside the file. Hope this helps.

0 Karma
Get Updates on the Splunk Community!

Unlock New Opportunities with Splunk Education: Explore Our Latest Courses!

At Splunk Education, we’re dedicated to providing top-tier learning experiences that cater to every skill ...

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...