Splunk Search

transform negative match

jhedgpeth
Path Finder

I'm trying to send certain events ("IdcServerThread" stuff) to nullQueue unless there's a specific pattern in it (the "verbose:" stuff). I'm not able to perform a positive match on all the other possibilities, so I'm trying a negative lookahead. What am I doing wrong?

KEEP LINE:

system  10.28 18:25:05.078    IdcServerThread-24       Configuring tracing verbose: false; sections: system, indexer, requestaudit

DISCARD LINE:

requestaudit    10.28 18:25:01.753   IdcServerThread-23 Ending request thread leaving behind 0 active request threads

props.conf

[source::.../*stub/etc/log]
sourcetype = stellent_log
TRANSFORMS-stellent = no_stellent_verbose

transforms.conf

[no_stellent_verbose]
REGEX = IdcServerThread-\d+\s+(?!Configuring)
DEST_KEY = queue
FORMAT = nullQueue
Tags (1)
1 Solution

southeringtonp
Motivator

You can match on everything, then override it for the subset you want to keep.

Take a look at:
http://www.splunk.com/base/Documentation/4.1.5/Admin/Routeandfilterdata#Keep_specific_events_and_dis...

transforms.conf:

[stellent_setnull]
REGEX = IdcServerThread
DEST_KEY = queue
FORMAT = nullQueue

[stellent_keep]
REGEX = IdcServerThread[\d\-\s]+Configuring
DEST_KEY = queue
FORMAT = indexQueue

props.conf

[source::.../*stub/etc/log]
sourcetype = stellent_log
TRANSFORMS-stellent = stellent_setnull, stellent_keep

The indexer will set all matching events to nullQueue, but then reset the "verbose" ones back to indexQueue.

View solution in original post

southeringtonp
Motivator

You can match on everything, then override it for the subset you want to keep.

Take a look at:
http://www.splunk.com/base/Documentation/4.1.5/Admin/Routeandfilterdata#Keep_specific_events_and_dis...

transforms.conf:

[stellent_setnull]
REGEX = IdcServerThread
DEST_KEY = queue
FORMAT = nullQueue

[stellent_keep]
REGEX = IdcServerThread[\d\-\s]+Configuring
DEST_KEY = queue
FORMAT = indexQueue

props.conf

[source::.../*stub/etc/log]
sourcetype = stellent_log
TRANSFORMS-stellent = stellent_setnull, stellent_keep

The indexer will set all matching events to nullQueue, but then reset the "verbose" ones back to indexQueue.

Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...