Getting Data In

How to not index certain messages from splunkd on the fwd servers

brent_weaver
Builder

I am trying to minimize the amount of apps I have by putting paths into inputs.conf that may or may not exist on all hosts in the serverclass. I am getting a ton of the following:

12-18-2015 16:58:33.907 +0000 WARN  FilesystemChangeWatcher - error getting attributes of path "e:\Directory": The device is not ready.

I realize that this is legit, but how can I make it so Splunk does not index these events?

0 Karma

brent_weaver
Builder

Thank you all! I looked for this category in log.cfg and could not find it. Do I add it?

0 Karma

yannK
Splunk Employee
Splunk Employee

you can add it.

[splunkd]
category.FileInputTracker=ERROR

0 Karma

yannK
Splunk Employee
Splunk Employee

Another solution is to tune your log level to stop recording those "WARN" events for the category "FilesystemChangeWatcher"

on the forwarder, take a look at $SPLUNK_HOME/etc/log.cfg
change the log level for FilesystemChangeWatcher to "ERROR" and restart to apply
see http://docs.splunk.com/Documentation/Splunk/6.3.1511/AdvancedDev/ModInputsLog

the_wolverine
Champion

You can drop these events at the indexer during parsing (before they are indexed) or use a heavy forwarder to parse the events out before sending to your indexer:

https://answers.splunk.com/answers/111257/universal-forwarder-nullqueue.html

0 Karma

brent_weaver
Builder

Thank you for the response, i set this up and it is not working. I think I have the REGEX field wrong.

Props.conf:

[splunkd]
TRANSFORMS = nullMon

Transforms.conf:

[nullMon]
REGEX = .*FilesystemChangeWatcher.*
DEST_KEY = queue
FORMAT = nullQueue
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...