I need help in creating props for the data input. The line should break after Block Output Operation 0.
Below is my props configured on the indexer:
[sourcetype]
[sas_input]
TIME_FORMAT = %Y-%m-%dT%H:%M:%S,%3N
TIME_PREFIX = Timestamp
MAX_TIMESTAMP_LOOKAHEAD = 128
SHOULD_LINEMERGE = true
MUST_BREAK_AFTER = Block Output Operations\s+\d+
#BREAK_ONLY_BEFORE_DATE = false
MAX_EVENTS = 10000
KV_MODE = multi
NO_BINARY_CHECK = true
category = Custom
disabled = false
pulldown_type = true
Below is my event indexed in Splunk:
Timestamp 07/13/2015 12:26:51 PM
Page Faults 0
Page Reclaims 62
Page Swaps 0
Voluntary Context Switches 2
Involuntary Context Switches 2
Block Input Operations 0
Block Output Operations 0
NOTE: The data set has 1 observations and 1 variables.
NOTE: DATA statement used (Total process time):
real time 0.39 seconds
user cpu time 0.00 seconds
system cpu time 0.01 seconds
memory 325.81k
OS Memory 9508.00k
How do I eliminate the lines NOTE: to OS Memory from my event.
Please let me know.
Thanks,
Mohammed Mohiuddin
This should work but you need to deploy it to your indexers (or Heavy Forwarders) and restart each Splunk instance before it will take effect. You might also look into sending the "NOTE" events into nullQueue
; what you have done so far simply detaches them from the events you would like to keep but they still exist as their own separate events:
http://docs.splunk.com/Documentation/Splunk/6.2.4/Forwarding/Routeandfilterdatad