Splunk Search

filter source

chanduira
Explorer

Hi Experts,

I am getting data from 10 sources, I want to send 3 source data to nullque.

I tried with below props.conf and transforms.conf configuration. But first source is filtering events from reset is not working.

vi props.conf
[source::ghcmapp]
[source::lsof]
[source::ps]
TRANSFORMS-null = setnull

vi transforms.conf

[setnull]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue

Tags (1)
0 Karma

chanduira
Explorer

Tried with individual stanza for each source, but its not working.

0 Karma

renjith_nair
Legend

You original config entries might be different but just to confirm, did you add TRANSFORMS-null=setnull under each of the source stanza? If not add the entry to each of the source stanza you want to filter- in this case ghcmapp,lsof,ps

You can set its based on sourcetype spec also , for eg:

[ps]
TRANSFORMS-null = setnull

http://docs.splunk.com/Documentation/Splunk/6.4.2/Forwarding/Routeandfilterdatad#Discard_specific_ev...

---
What goes around comes around. If it helps, hit it with Karma :slightly_smiling_face:
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...