Hi @yashb Ive used INGEST_EVAL to achieve this for a customer previously, although as @richgalloway you may be able to achieve this with Ingest Actions too. Here is the sample props/transforms for...
See more...
Hi @yashb Ive used INGEST_EVAL to achieve this for a customer previously, although as @richgalloway you may be able to achieve this with Ingest Actions too. Here is the sample props/transforms for INGEST_EVAL == props.conf ==
[yourSourcetype]
TRANSFORMS-dropBigEvents = dropBigEvents
== transforms.conf ==
[dropBigEvents]
INGEST_EVAL = queue=IF(len(_raw)>=10000,"nullQueue",queue) You could also achieve this with a regex match, however I think this would be resource intensive, so personally would use the INGEST_EVAL route, but including this for completeness. [dropBigEvents]
REGEX = ^.{10000,}
DEST_KEY = queue
FORMAT = nullQueue Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing