Splunk Search

Skipping Index after transformation

kkamatchisundar
New Member

I have certain logs in which I had to change the format of the logs.For this a custom sourcetype containing the transformation regex was created and applied over the logs.
Now done with the transformation.But the problem is I dont want these transformed logs to undergo the indexing process.
Also I want these transformed logs to be directed to an external file wihtout getting stored in splunk.How to do this in splunk.

Please advise.

Tags (2)
0 Karma

Ayn
Legend

You can't do this in Splunk. Logs that are entered into Splunk are either indexed, forwarded or dropped. Your option might be to forward it via TCP or similar to a third party system that then writes it to file, but it sounds to me you're looking for the wrong tool for the wrong job.

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...