splunk discard specific events

[pdash]

{[-] EventInfo : {[+]}, EventType : "INFO", Properties : {[+]}, TimeStamp : "2014-01-03T19:31:30.3319998Z" }

How do i discard events that have EventType = INFO?

Currently my transforms and props are:

(transforms)

[treessvcignore] 
REGEX = \"EventType\"\:\"INFO\" 
DEST_KEY = queue 
FORMAT = nullQueue

(props)

[host::TREESSVC*] 
TRANSFORMS-null = treessvcignore

This data is in json format

The raw data looks like this
The raw event is

{"EventType":"INFO","TimeStamp":"2014-01-03T06:59:59.9645694Z","Properties":{"StackId":"PER_RNK","applicationClass":"CollatorApplication","name":"PersonRank","type":"Collator","serverClassType":"Live","serverClassApplication":"Multi","ComponentId":"PersonRank","ClientId":"Unknown","ClassName":"CollatorHandlers","MethodName":"Query","ClientPath":"Unknown","RequestPath":"a61a2538-9ef6-4c2c-8579-0d6e073c4159","Metric":...

[lguinn2]

dwaddle 's answer is great, but I think I see some typos in your REGEX, based on the sample event. I would do it this way

REGEX = "EventType"\s*:\s*"INFO" 

ah - I didn't see the quotes at first in the raw data.

[pdash]

Doesnot work either. It still shows up newly indexed data that have info in eventtype

[dwaddle]

I tested your configuation on my test system with your example event, and it seems to have filtered the event just fine. So I believe your configuration is (fundamentally) correct. Some questions:

1. Where is this configuration defined? On a forwarder, or the indexer? With Light or Universal forwarders, this configuration needs to be installed at the indexer. If there is a heavy forwarder in your environment, it needs to be at the first heavy forwarder that will touch the event.
2. Have you restarted Splunk since applying this change?
3. Are these configs in an app or in the $SPLUNK_HOME/etc/system/local directory?
4. Have you checked with the btool command to make sure your config is not being overridden by some other app? ( http://blogs.splunk.com/2012/10/02/tips-and-tricks-for-the-new-guy/ )

[pdash]

Thanks. So its on indexer not on forwarder. And within splunkhome/etc/system/local dir. Also i restarted to make the changes effective