Getting Data In

extracting from logs before indexing to server

dhs_harry08
Path Finder

Hi

Is there a way to extract a part of log event before it being indexed to splunk server for example
Below is the entire event.

====================
{ActiveMQ Session Task} DEBUG LogCollector - start[1311770824360] time[474] tag[card;cardCreation;cardCreation End] host[hagrid.hyd.wc;127.0.0.1]
{ActiveMQ Session Task} DEBUG PerfLoggerDAOImpl - getting ServiceOperationInfo
Hibernate: select serviceope1_.id as id2_, serviceope1_.service_id as service2_2_, serviceope1_.operation_name as operation3_2_, serviceope1_.operation_descr as operation4_2_, serviceope1_.status as status2_ from service_info serviceinf0_, service_operation_info serviceope1_ where serviceope1_.service_id=serviceinf0_.id and serviceinf0_.name=? and serviceope1_.operation_name=?
Hibernate: select serviceinf0_.id as id1_0_, serviceinf0_.name as name1_0_, serviceinf0_.description as descript3_1_0_, serviceinf0_.type as type1_0_, serviceinf0_.status as status1_0_ from service_info serviceinf0_ where serviceinf0_.id=?
{ActiveMQ Session Task} DEBUG PerfLoggerDAOImpl - saving TaskExecutionInfo instance
=============

But I want only to see this "start[1311770824360] time[474] host[hagrid.hyd.wc;127.0.0.1]" in my indexer and the rest of part should be ignored. the filtering to be done on the client side only.
Is this possible.
Regards,
Harish

0 Karma

dhs_harry08
Path Finder

I am actually using splunk forwarder. Is it possible to specify in splunk forwarding config files or write some script to filter out the my application logs.

Regards,
Harish

0 Karma

Damien_Dallimor
Ultra Champion

I'm going to presume that your source application is using log4j as its logging framework(because activemq uses log4j) , therefore you could declare a seperate log4j appender in your log4j config file that outputs only the log data you want to send to the Splunk Indexer.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...