I have a server of which logs are indexed on splunk. The server is universal forwarder and sends a log file continuously to the Splunk to index. The logs have a lot of events with "INFO". I require that the events with "INFO" should be discarded and will not indexed by splunk.
To attain the same i had made following changes on Indexer as my forwarder is universal forwarder.
Path: /opt/splunk/etc/apps/search/local/props.conf
[host::abcd.global.trafigura.com]
sourcetype = abcd Log
TRANSFORMS-null= setnull, setparsing
Path: /opt/splunk/etc/apps/search/local/transforms.conf
[setnull]
REGEX = INFO
DEST_KEY = queue
FORMAT = nullQueue
[setparsing]
REGEX = .
DEST_KEY = queue
But i'm not able to discard the events with INFO. Please help.
Remove the setparsing part - that's for the opposite, "remove everything except the regex in the setparsing stanza". In your case, the dot matches everything so it keeps everything.
TRANSFORMS-null = setnull
As a general advice, make sure your regex INFO
doesn't accidentally discard events that are of loglevel ERROR but happen to contain INFO somewhere else.
Remove the setparsing part - that's for the opposite, "remove everything except the regex in the setparsing stanza". In your case, the dot matches everything so it keeps everything.
TRANSFORMS-null = setnull
As a general advice, make sure your regex INFO
doesn't accidentally discard events that are of loglevel ERROR but happen to contain INFO somewhere else.
Check if the host name is correct? IMO, the setparsing stanza is not required. Hope you restarted your indexer after making this change.
Also, routing and filtering for structured data happens on UF itseft so can you confirm if your log data is structured or not. (see this http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad#Caveats_for_routin...)