How do I ignore a string of asterisks ("*") in props.conf?

[a548506]

Hello I am trying to ignore a string of ***** that are showing up in my data. The asterisks are showing up before Processing Interface system: and after Processed Interface System.

This is the data sample:

*************************************************


Processing Interface system: SOME STRING HERE ...

Command: DUMMY DATA HERE

Connecting to IP.ADDRESS.HERE...
NO FILE(s) EXIST ON REMOTE DIRECTORY: SOME PATH HERE..

Processed Interface System   : SOME STRING HERE

*************************************************


Processing Interface system: SOME STRING HERE ...

Command: DUMMY DATA HERE

Connecting to IP.ADDRESS.HERE...
NO FILE(s) EXIST ON REMOTE DIRECTORY: SOME PATH HERE..

Processed Interface System   : SOME STRING HERE

*************************************************

My Props.conf:

SHOULD_LINEMERGE=true
NO_BINARY_CHECK=true
BREAK_ONLY_BEFORE=\w{10,} \w{9} \w{6}:
MUST_BREAK_AFTER=\w{9} \w{9} \w{6}  

I am breaking the events off of: Processing Interface system and must break after:Processed Interface System. This is how the customer wants the data broken up by. We are totally ignoring the timestamps,

How can I also ignore the ********* that are showing up as "events" in Splunk?

Thanks!

[somesoni2 · Accepted solution]

You can either use SEDCMD command in props.conf to remove thos (make the event with asterisk as blank so that Splunk will drop those) or use props-transforms to route those events to nullQueue (won't be indexed.)

SEDCMD
props.conf

[yourSourcetype]
SHOULD_LINEMERGE=true
NO_BINARY_CHECK=true
BREAK_ONLY_BEFORE=\w{10,} \w{9} \w{6}:
MUST_BREAK_AFTER=\w{9} \w{9} \w{6}  
SEDCMD-removejunk = s/^\*+.+//g

Props-transforms
props.conf

[yourSourcetype]
SHOULD_LINEMERGE=true
NO_BINARY_CHECK=true
BREAK_ONLY_BEFORE=\w{10,} \w{9} \w{6}:
MUST_BREAK_AFTER=\w{9} \w{9} \w{6} 
TRANSFORMS-removejunk = remove_asterisks_line

transforms.conf

[remove_asterisks_line]
REGEX = ^\*+
FORMAT = nullQueue
DEST_KEY = queue

[a548506]

somesoni2,

This worked like a charm. Thank you for providing two separate configurations. I went ahead and went the transforms route.

Thanks again.

[mfrost8]

Are you looking to prevent those asterisk lines from being indexed at all? If so, have a look at
https://answers.splunk.com/answers/232641/is-there-a-way-to-ignore-certain-events.html