Splunk Search

Skipping Index after transformation

kkamatchisundar
New Member

I have certain logs in which I had to change the format of the logs.For this a custom sourcetype containing the transformation regex was created and applied over the logs.
Now done with the transformation.But the problem is I dont want these transformed logs to undergo the indexing process.
Also I want these transformed logs to be directed to an external file wihtout getting stored in splunk.How to do this in splunk.

Please advise.

Tags (2)
0 Karma

Ayn
Legend

You can't do this in Splunk. Logs that are entered into Splunk are either indexed, forwarded or dropped. Your option might be to forward it via TCP or similar to a third party system that then writes it to file, but it sounds to me you're looking for the wrong tool for the wrong job.

Get Updates on the Splunk Community!

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Shape the Future of Splunk: Join the Product Research Lab!

Join the Splunk Product Research Lab and connect with us in the Slack channel #product-research-lab to get ...