All Apps and Add-ons

change input.conf

vumanhtai
Path Finder

Hi!
input.conf in Splunk-TA-Window
this default
"[WinEventLog://System]
disabled = 0
start_from = oldest
current_only = 0
checkpointInterval = 5
index = wineventlog
renderXml=false"

I just want to get log error. how do i change it!

0 Karma

sandyIscream
Communicator

You need to write props.conf and transforms.conf when you want to filter any data.

In your case you need construct your props.conf like below.

[sourcetype]
TRANSFORMS-set =setnull, Error

transforms.conf

[setnull] --------------------------------------this is direct all the unwanted data to null queue. (Same as dev/null for linux)
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue

[Error] ---------------------- It will filter all the events which have ERROR keyword in them and redirect them to your index
REGEX = ERROR
DEST_KEY = queue
FORMAT = indexQueue

0 Karma

mayurr98
Super Champion
0 Karma

vumanhtai
Path Finder

thank! you

0 Karma

mayurr98
Super Champion

hey @vumanhtai

does this help you?

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...