Hi. I am new to Splunk and I am trying to prevent specific logs to be collected. I have 3 Etehrnet switches and they generate a lot of garbage and I don't want my logs to be filled by unnecessary entries. I already know that I need to create "stuff" inside props.conf and transforms.conf.
In fact, what I want to do is to send to the nullQueue everything that comes from port udp 514 and that contains the word MSGBUILDER inside the _raw field.
Here is what I did:
Props.conf
[source::UDP:514]
TRANSFORMS-set= setnull
Transforms.conf
[setnull]
REGEX= MSGBUILDER
DEST_KEY = queue
FORMAT = nullQueue
There must be something I do not do properly because it doesn't work. Splunk continues to collect these logs instead of excluding them.
Anyone can help?
Thanks.
Hi jonuwz,
thanks for your answer but it's my mistake. I typed UDP (UPPER CASE) here but I definitely wrote udp (lower case) in props.conf.
Another idea someone?
Thanks.
Pretty sure UDP should be udp in props.conf
[source::udp:514]
TRANSFORMS-set= setnull
Update....
Have you restarted splunk since making the changes?
You're welcome.
Guess what? Either I'm lying or I must be blind but you were absolutely right. I double checked it this morning and udp was typed in UPPER CASE. Now it seems to work like a charm. Thank you very much.