Splunk Search

transform negative match

jhedgpeth
Path Finder

I'm trying to send certain events ("IdcServerThread" stuff) to nullQueue unless there's a specific pattern in it (the "verbose:" stuff). I'm not able to perform a positive match on all the other possibilities, so I'm trying a negative lookahead. What am I doing wrong?

KEEP LINE:

system  10.28 18:25:05.078    IdcServerThread-24       Configuring tracing verbose: false; sections: system, indexer, requestaudit

DISCARD LINE:

requestaudit    10.28 18:25:01.753   IdcServerThread-23 Ending request thread leaving behind 0 active request threads

props.conf

[source::.../*stub/etc/log]
sourcetype = stellent_log
TRANSFORMS-stellent = no_stellent_verbose

transforms.conf

[no_stellent_verbose]
REGEX = IdcServerThread-\d+\s+(?!Configuring)
DEST_KEY = queue
FORMAT = nullQueue
Tags (1)
1 Solution

southeringtonp
Motivator

You can match on everything, then override it for the subset you want to keep.

Take a look at:
http://www.splunk.com/base/Documentation/4.1.5/Admin/Routeandfilterdata#Keep_specific_events_and_dis...

transforms.conf:

[stellent_setnull]
REGEX = IdcServerThread
DEST_KEY = queue
FORMAT = nullQueue

[stellent_keep]
REGEX = IdcServerThread[\d\-\s]+Configuring
DEST_KEY = queue
FORMAT = indexQueue

props.conf

[source::.../*stub/etc/log]
sourcetype = stellent_log
TRANSFORMS-stellent = stellent_setnull, stellent_keep

The indexer will set all matching events to nullQueue, but then reset the "verbose" ones back to indexQueue.

View solution in original post

southeringtonp
Motivator

You can match on everything, then override it for the subset you want to keep.

Take a look at:
http://www.splunk.com/base/Documentation/4.1.5/Admin/Routeandfilterdata#Keep_specific_events_and_dis...

transforms.conf:

[stellent_setnull]
REGEX = IdcServerThread
DEST_KEY = queue
FORMAT = nullQueue

[stellent_keep]
REGEX = IdcServerThread[\d\-\s]+Configuring
DEST_KEY = queue
FORMAT = indexQueue

props.conf

[source::.../*stub/etc/log]
sourcetype = stellent_log
TRANSFORMS-stellent = stellent_setnull, stellent_keep

The indexer will set all matching events to nullQueue, but then reset the "verbose" ones back to indexQueue.

Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...