Splunk Search

filter blank events coming from syslog

mcafeesecure
Explorer

This is probably something simple that I am missing.

Is there a way to filter out what are esentially blank log entries from syslog?

I get messages with the timestamp and hostname, process/PID but no data.

Unfortunatly, I don't think this will be fixed in the app anytime soon, so I need a way to filter this out at search time, unfortunatly the PID is in the log so that's not uniform, and I can't filter out based on what IS there, as that would filter out the messages that do have data. Example log lines below.

Jan 13 10:21:39 hostname.domain.com process[PID]: data is here that I want
Jan 13 10:21:39 hostname.domain.com process[PID]: 

obviously I would want to keep the first, but discard the second

Tags (2)
0 Karma

Damien_Dallimor
Ultra Champion

You can filter out those syslog messages you don't want and route them to the null queue so they wont be indexed.

props.conf

[syslog_sourcetype]
TRANSFORMS-null= syslogfilter

transforms.conf

[syslogfilter]
REGEX = ^.+process\[\d+\]:$
DEST_KEY = queue
FORMAT = nullQueue

Check out this link at Splunk docs for more details

sbrant_tt
Explorer

This should work for what you're trying to do. If the "blank" message contains spaces, you may have to adjust the evaluation at the end but this is the general idea:

... | rex field=_raw "]:(?<message>.*)" | search message!=""
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...