Getting Data In

Removing Garbled logs by linecount before indexing

twistedsixty4
Path Finder

Hey everyone,
So I have a script that generates status logs for a few network devices that my Splunk forwarder grabs, but every now and again something screws it up and it garbles the entry. The garbled entry is always a smaller linecount, this accounts for roughly 1% of my logs from the script. Is there a way to tell Splunk in the props file to throw away the entry if it's less than 23 lines long? Thanks!

0 Karma
1 Solution

yannK
Splunk Employee
Splunk Employee

Not if you monitor the log file with a [monitor]
and the nullQueue filtering will only work on a line per line basis.

If you were using a scripted input, then you could add some logic when you generate the logs to drop the invalid ones.

View solution in original post

0 Karma

yannK
Splunk Employee
Splunk Employee

Not if you monitor the log file with a [monitor]
and the nullQueue filtering will only work on a line per line basis.

If you were using a scripted input, then you could add some logic when you generate the logs to drop the invalid ones.

0 Karma

twistedsixty4
Path Finder

thanks for your help, i've adjusted my script, oh well.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

yes, something like if result count < 23 don't write anything (to file or to script output)

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...