Splunk Search

Why is the Null Queue Not Working?

Path Finder

Hello,

Here is a sample log event I would like to filter:

20180307 11:11:08.795 [process:flow] [INFO] Thread is returning to available thread pool DM.Appl.ThreadPool

Here is current props.conf
[source::/opt/CA/tracelog.txt]
TRANSFORMS-null= setnull

Here is current transforms.conf
[setnull]
REGEX = (?i)[INFO]
DEST_KEY = queue
FORMAT = nullQueue

I would like to send all events that contain [INFO] to null queue but the current configurations on the indexer do not seem to be working. Any thoughts on what might be wrong?

Thanks!

0 Karma
1 Solution

SplunkTrust
SplunkTrust

hI jordanking1992,
square parenthesis is a special char for regexes so you have to escape them, try

REGEX = (?i)\[INFO\]

Bye.
Giuseppe

View solution in original post

SplunkTrust
SplunkTrust

hI jordanking1992,
square parenthesis is a special char for regexes so you have to escape them, try

REGEX = (?i)\[INFO\]

Bye.
Giuseppe

View solution in original post

Path Finder

Giuseppe,

Thank you so much. Cant believe it was something so simple.

Respectfully,
Jordan

0 Karma

SplunkTrust
SplunkTrust

Hi hI jordanking1992,
if you're satisfied by this answer please accept and/or upvote it.
Bye.
Giuseppe

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!