Hi ,
We want to filter the following data using REGEX in props.conf and tansforms.conf but still the data is coming into Splunk. We have tried few methods but still logs are reaching splunk so kindly help on this request.
Put this in your transforms.conf
[GET-to-nullQueue]
REGEX=\d+\s\-\s-\s\d{3}
DEST_KEY=queue
FORMAT=nullQueue
Place this in your props.conf
[YOUR_Sourcetype]
TRANSFORMS-t1=GET-to-nullQueue
Restart your Splunkd service for the changes to take affect.. This will not work retroactively, this will only work on new events coming in
So which way do you want the decision made? Pick one -
A) Kill anything that starts with GET
B) Keep anything that starts with POST
C) Keep anything that has Java/* in that position.
Put this in your transforms.conf
[GET-to-nullQueue]
REGEX=\d+\s\-\s-\s\d{3}
DEST_KEY=queue
FORMAT=nullQueue
Place this in your props.conf
[YOUR_Sourcetype]
TRANSFORMS-t1=GET-to-nullQueue
Restart your Splunkd service for the changes to take affect.. This will not work retroactively, this will only work on new events coming in
skoelpins regex is right, but you could also use this visually more pleasing one
REGEX=(?=(?>\s\-\s\-\s))
just sayin :3
Hi Anand, please update us your current props.conf, so that we can understand your current configuration and suggest.