Hello,
I have to index only events that contains the string "$$log$$".
I try with a transforms like
[ignore]
REGEX = < a regex to match event not containing "$$log$$" >
DEST_KEY = queue
FORMAT = nullQueue
How can I wrote a "not match" regex (like !~ in perl)?
Thank's
Christian
Instead of using the 'not match' regex and drop those events, you do 'match' regex and index those matching events, and drop everything else. Something on the lines of
In props.conf (keep the exact same order of transforms):
[source::/var/log/messages]
TRANSFORMS-set= setnull,setparsing
In transforms.conf:
[setnull]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue
[setparsing]
REGEX = \$\$log\$\$
DEST_KEY = queue
FORMAT = indexQueue
See this for more details.
Regex doesn't do NOT very well. Your best bet is write a regex that matches want you want to keep and send everything else to nullQueue. See the answer at https://answers.splunk.com/answers/111362/filtering-of-events-using-nullqueue.html.
Instead of using the 'not match' regex and drop those events, you do 'match' regex and index those matching events, and drop everything else. Something on the lines of
In props.conf (keep the exact same order of transforms):
[source::/var/log/messages]
TRANSFORMS-set= setnull,setparsing
In transforms.conf:
[setnull]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue
[setparsing]
REGEX = \$\$log\$\$
DEST_KEY = queue
FORMAT = indexQueue
See this for more details.