Getting Data In

Filtering application log

keshab
Path Finder

I am new to this Splunk...I have universal forwarder installed on my two linux machine and successfully forwarding apache, tomcat logs to another linux machine which has Splunk server(indexer) using tcp port. Now I want to filter those logs based on REGEX. I was just wondering which files and which section of the files should I make the changes on universal forwarder and splunk index??

0 Karma

jasonchangbompa
Explorer

Hi, I have an open question about splunk "log filtering" performance.

Is there any document or technical report mentioning about performance metrics which clearly shows case-by-case (e.g. depending on number of cores, etc) filtering performance?

Nothing comes out of my mind at this point regarding this performance issue, yet.
But I guess you know what I'm talking about...

Best Wishes, Sung Jin

0 Karma

kdenton
Path Finder

You could also install the heavy forwarder which is basically a full install of Splunk with some features disabled to help reduce the foot print.

Useing the heavy forwarder you can filter based on regex.

0 Karma

_d_
Splunk Employee
Splunk Employee

Keshab,

A universal forwarder is not able to do any filtering based on regex (with the exception of having regex based whitelists in your inputs.conf stanza so that you selectively bring files in to your Splunk indexer) but an indexer will.

There are two main files that you can use to achieve what you're looking for. Create these file in $SPLUNK_HOME/etc/system/local and modify them accordingly.

  1. props.conf :: http://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf
  2. transforms.conf :: http://docs.splunk.com/Documentation/Splunk/latest/Admin/Transformsconf

The links above cover all file options/parameters and also come with a few examples.
A few more resources:

field extractions: http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Createandmaintainsearch-timefieldextrac...

route and filter logs: http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Routeandfilterdatad

Hope this helps.

> please upvote and accept answer if you find it useful - thanks!

Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...