Splunk Search

filter source

chanduira
Explorer

Hi Experts,

I am getting data from 10 sources, I want to send 3 source data to nullque.

I tried with below props.conf and transforms.conf configuration. But first source is filtering events from reset is not working.

vi props.conf
[source::ghcmapp]
[source::lsof]
[source::ps]
TRANSFORMS-null = setnull

vi transforms.conf

[setnull]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue

Tags (1)
0 Karma

chanduira
Explorer

Tried with individual stanza for each source, but its not working.

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

You original config entries might be different but just to confirm, did you add TRANSFORMS-null=setnull under each of the source stanza? If not add the entry to each of the source stanza you want to filter- in this case ghcmapp,lsof,ps

You can set its based on sourcetype spec also , for eg:

[ps]
TRANSFORMS-null = setnull

http://docs.splunk.com/Documentation/Splunk/6.4.2/Forwarding/Routeandfilterdatad#Discard_specific_ev...

Happy Splunking!
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...