filter blank events coming from syslog

[mcafeesecure]

This is probably something simple that I am missing.

Is there a way to filter out what are esentially blank log entries from syslog?

I get messages with the timestamp and hostname, process/PID but no data.

Unfortunatly, I don't think this will be fixed in the app anytime soon, so I need a way to filter this out at search time, unfortunatly the PID is in the log so that's not uniform, and I can't filter out based on what IS there, as that would filter out the messages that do have data. Example log lines below.

Jan 13 10:21:39 hostname.domain.com process[PID]: data is here that I want
Jan 13 10:21:39 hostname.domain.com process[PID]: 

obviously I would want to keep the first, but discard the second

[Damien_Dallimor]

You can filter out those syslog messages you don't want and route them to the null queue so they wont be indexed.

props.conf

[syslog_sourcetype]
TRANSFORMS-null= syslogfilter

transforms.conf

[syslogfilter]
REGEX = ^.+process\[\d+\]:$
DEST_KEY = queue
FORMAT = nullQueue

Check out this link at Splunk docs for more details

[sbrant_tt]

This should work for what you're trying to do. If the "blank" message contains spaces, you may have to adjust the evaluation at the end but this is the general idea:

... | rex field=_raw "]:(?<message>.*)" | search message!=""