Splunk Search

transform negative match

Path Finder

I'm trying to send certain events ("IdcServerThread" stuff) to nullQueue unless there's a specific pattern in it (the "verbose:" stuff). I'm not able to perform a positive match on all the other possibilities, so I'm trying a negative lookahead. What am I doing wrong?

KEEP LINE:

system  10.28 18:25:05.078    IdcServerThread-24       Configuring tracing verbose: false; sections: system, indexer, requestaudit

DISCARD LINE:

requestaudit    10.28 18:25:01.753   IdcServerThread-23 Ending request thread leaving behind 0 active request threads

props.conf

[source::.../*stub/etc/log]
sourcetype = stellent_log
TRANSFORMS-stellent = no_stellent_verbose

transforms.conf

[no_stellent_verbose]
REGEX = IdcServerThread-\d+\s+(?!Configuring)
DEST_KEY = queue
FORMAT = nullQueue
Tags (1)
1 Solution

Motivator

You can match on everything, then override it for the subset you want to keep.

Take a look at:
http://www.splunk.com/base/Documentation/4.1.5/Admin/Routeandfilterdata#Keep_specific_events_and_dis...

transforms.conf:

[stellent_setnull]
REGEX = IdcServerThread
DEST_KEY = queue
FORMAT = nullQueue

[stellent_keep]
REGEX = IdcServerThread[\d\-\s]+Configuring
DEST_KEY = queue
FORMAT = indexQueue

props.conf

[source::.../*stub/etc/log]
sourcetype = stellent_log
TRANSFORMS-stellent = stellent_setnull, stellent_keep

The indexer will set all matching events to nullQueue, but then reset the "verbose" ones back to indexQueue.

View solution in original post

Motivator

You can match on everything, then override it for the subset you want to keep.

Take a look at:
http://www.splunk.com/base/Documentation/4.1.5/Admin/Routeandfilterdata#Keep_specific_events_and_dis...

transforms.conf:

[stellent_setnull]
REGEX = IdcServerThread
DEST_KEY = queue
FORMAT = nullQueue

[stellent_keep]
REGEX = IdcServerThread[\d\-\s]+Configuring
DEST_KEY = queue
FORMAT = indexQueue

props.conf

[source::.../*stub/etc/log]
sourcetype = stellent_log
TRANSFORMS-stellent = stellent_setnull, stellent_keep

The indexer will set all matching events to nullQueue, but then reset the "verbose" ones back to indexQueue.

View solution in original post

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!