transform negative match

[jhedgpeth]

I'm trying to send certain events ("IdcServerThread" stuff) to nullQueue unless there's a specific pattern in it (the "verbose:" stuff). I'm not able to perform a positive match on all the other possibilities, so I'm trying a negative lookahead. What am I doing wrong?

KEEP LINE:

system  10.28 18:25:05.078    IdcServerThread-24       Configuring tracing verbose: false; sections: system, indexer, requestaudit

DISCARD LINE:

requestaudit    10.28 18:25:01.753   IdcServerThread-23 Ending request thread leaving behind 0 active request threads

props.conf

[source::.../*stub/etc/log]
sourcetype = stellent_log
TRANSFORMS-stellent = no_stellent_verbose

transforms.conf

[no_stellent_verbose]
REGEX = IdcServerThread-\d+\s+(?!Configuring)
DEST_KEY = queue
FORMAT = nullQueue

[southeringtonp · Accepted solution]

You can match on everything, then override it for the subset you want to keep.

Take a look at:
http://www.splunk.com/base/Documentation/4.1.5/Admin/Routeandfilterdata#Keep_specific_events_and_dis...

transforms.conf:

[stellent_setnull]
REGEX = IdcServerThread
DEST_KEY = queue
FORMAT = nullQueue

[stellent_keep]
REGEX = IdcServerThread[\d\-\s]+Configuring
DEST_KEY = queue
FORMAT = indexQueue

props.conf

[source::.../*stub/etc/log]
sourcetype = stellent_log
TRANSFORMS-stellent = stellent_setnull, stellent_keep

The indexer will set all matching events to nullQueue, but then reset the "verbose" ones back to indexQueue.