Getting Data In

I have log files. I want to ignore all the lines after a particular line from a log file. Can I do this with the help of sedcmd command? If yes then please tell me how can I do that?

saibal6
Path Finder

EVENT_SESH;0;01/03/2018 22:57:27:5000;1;1;0;;;END OF IMPORT PROCESS FOR THE MASTER STORE - PENDING_TXT(0)

after this line I want to ignore all the lines before indexing from the log files. Please suggest me how can i do this with the help of sedcmd command. I am using universal forwarder.

Please also tell me the exact path where I have to make changes for props.conf. I'm using windows OS

0 Karma

JDukeSplunk
Builder

This answer might help you.

https://answers.splunk.com/answers/594894/blacklist-log-events-not-log-filenames-using-a-str.html

This basically black-holes data that meets a specific regex. Of course, if the lines are not uniform this will be difficult.

http://docs.splunk.com/Documentation/Splunk/7.0.2/Forwarding/Routeandfilterdatad

0 Karma

saibal6
Path Finder

forgot to mention my source name (source: D:\CentralData\MONACO)

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...