{[-] EventInfo : {[+]}, EventType : "INFO", Properties : {[+]}, TimeStamp : "2014-01-03T19:31:30.3319998Z" }
How do i discard events that have EventType = INFO?
Currently my transforms and props are:
(transforms)
[treessvcignore]
REGEX = \"EventType\"\:\"INFO\"
DEST_KEY = queue
FORMAT = nullQueue
(props)
[host::TREESSVC*]
TRANSFORMS-null = treessvcignore
This data is in json format
The raw data looks like this
The raw event is
{"EventType":"INFO","TimeStamp":"2014-01-03T06:59:59.9645694Z","Properties":{"StackId":"PER_RNK","applicationClass":"CollatorApplication","name":"PersonRank","type":"Collator","serverClassType":"Live","serverClassApplication":"Multi","ComponentId":"PersonRank","ClientId":"Unknown","ClassName":"CollatorHandlers","MethodName":"Query","ClientPath":"Unknown","RequestPath":"a61a2538-9ef6-4c2c-8579-0d6e073c4159","Metric":...
dwaddle 's answer is great, but I think I see some typos in your REGEX, based on the sample event. I would do it this way
REGEX = "EventType"\s*:\s*"INFO"
ah - I didn't see the quotes at first in the raw data.
Doesnot work either. It still shows up newly indexed data that have info in eventtype
I tested your configuation on my test system with your example event, and it seems to have filtered the event just fine. So I believe your configuration is (fundamentally) correct. Some questions:
$SPLUNK_HOME/etc/system/local
directory?btool
command to make sure your config is not being overridden by some other app? ( http://blogs.splunk.com/2012/10/02/tips-and-tricks-for-the-new-guy/ )Thanks. So its on indexer not on forwarder. And within splunkhome/etc/system/local dir. Also i restarted to make the changes effective