Getting Data In

How to configure props.conf and transforms.conf to index logs with a specific string and filter out all other events?

chanduira
Explorer

Hi Experts,

I am getting logs / events from an application server to an indexer. I want to index logs with the string "connected to machine" and drop rest all events.

Please help me with props.conf and transforms.conf file syntax.

0 Karma

joesrepsolc
Communicator

Trying to implement this myself... struggling. Reading the link woodcock supplied now.

0 Karma

woodcock
Esteemed Legend

Look here:

http://docs.splunk.com/Documentation/Splunk/6.3.1/Forwarding/Routeandfilterdatad#Keep_specific_event...

In props.conf:

[YourSourceOrSourceTypeHere]
TRANSFORMS-set= setnull,setparsing

In transforms.conf:

[setnull]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue

[setparsing]
REGEX = connected\sto\smachine
DEST_KEY = queue
FORMAT = indexQueue

Deploy to Indexers and restart all splunk instances there. This will apply ONLY to events indexed after the restart.

0 Karma

chanduira
Explorer

Thanks for response.
I my case I have two index and different source. So I want to forward logs to index logs in specifix indexer.

I tried below option but all logs get filtered.

[setnull]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue
[setparsing]
REGEX = connected\sto\smachine
DEST_KEY = queue
FORMAT = myindexname
0 Karma

woodcock
Esteemed Legend

It does not work that way. You set the destination index ( myindexname ) in inputs.conf. You must use FORMAT = indexQueue to pull it back out of the nullQueue.

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...