Hi,
I'm trying to filter out data after a specific event occurs.
I want to drop all of the search data to display in a timechart, after a this specific event.
The event (and all other data) is in the shape
{
"name": "NAME",
"value": "VALUE"
}
If the value from name=specific_name changes from 0 to 1 I want to drop all data after this change.
How can I do that?
If you need more information please ask! 🙂
Thanks!
i think this answer may help, its should be a quick props.conf and transforms.conf setting, we do this to filter out huge debug logs and other things application owners cant adjust on there side.
https://answers.splunk.com/answers/223818/how-to-write-the-regex-in-transformsconf-to-filter.html
More information plz. Assuming this NOT filtering of events from being ingested but rather doing a search time filter in your search. Please provide details about how your data looks (may be real data), what you're getting now and what you expect.