Splunk Search

Why is the Null Queue Not Working?

jordanking1992
Path Finder

Hello,

Here is a sample log event I would like to filter:

20180307 11:11:08.795 [process:flow] [INFO] Thread is returning to available thread pool DM.Appl.ThreadPool

Here is current props.conf
[source::/opt/CA/tracelog.txt]
TRANSFORMS-null= setnull

Here is current transforms.conf
[setnull]
REGEX = (?i)[INFO]
DEST_KEY = queue
FORMAT = nullQueue

I would like to send all events that contain [INFO] to null queue but the current configurations on the indexer do not seem to be working. Any thoughts on what might be wrong?

Thanks!

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

hI jordanking1992,
square parenthesis is a special char for regexes so you have to escape them, try

REGEX = (?i)\[INFO\]

Bye.
Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

hI jordanking1992,
square parenthesis is a special char for regexes so you have to escape them, try

REGEX = (?i)\[INFO\]

Bye.
Giuseppe

View solution in original post

king2jd
Path Finder

Giuseppe,

Thank you so much. Cant believe it was something so simple.

Respectfully,
Jordan

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi hI jordanking1992,
if you're satisfied by this answer please accept and/or upvote it.
Bye.
Giuseppe

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.