Splunk Search

How do you discard events from the cron.log?

scamarda
New Member

On my universal forwarder, I have a repeated entry in my cron.log file that I would like to discard. However, I am not very familiar with regex terms. The entry in the cron.log is:

hostname  CROND[27158]: (root) CMD (/bin/sh /etc/init.d/swiagentd swrestart > /dev/null 2&>1)

I have followed the instructions at:

https://docs.splunk.com/Documentation/Splunk/6.5.2/Forwarding/Routeandfilterdatad#Discard_specific_e...

and I am using the following:

props.conf
[source::/var/log/cron]
TRANSFORMS-null= setnull

transforms.conf
[setnull]
REGEX = swrestart
DEST_KEY = queue
FORMAT = nullQueue

I have restarted but I am still getting the message in my search. Do I have the correct regex? And is there a specific place in each .conf file that I should put the stanzas?

0 Karma

woodcock
Esteemed Legend

You need to deploy this to the first full instance of Splunk that handles the data (either HF or Indexer tier). You need to restart all Splunk instances there. You need to forward in NEW data (old data will remain) so add _index_earliest=-5m to your All time search.

0 Karma

petom
Path Finder

@scamarda if you want to do parsing of the input, you have to do it either on Heavy Forwarder or on Indexer.
Universal Forwarder is not capable of parsing or transforms.

The some good reading about it:
https://docs.splunk.com/Documentation/Splunk/7.2.3/Deploy/Datapipeline
and subsequently next page:
https://docs.splunk.com/Documentation/Splunk/7.2.3/Deploy/Componentsofadistributedenvironment

Other interesting article about where to configure what in the data pipeline and for which part of the pipeline is here:
https://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings

0 Karma

whrg
Motivator

Did you make this configuration on your Universal Forwarder?

I am asking this because the documentation on Route and filter data says:

You can use heavy forwarders to filter and route event data to Splunk instances.

So I believe that these kind of filters are not working on Universal Forwarders.

I suggest you put this configuration on the system which comes after the Universal Forwarder (probably a Heavy Forwarder or an Indexer) or replace the Universal Forwarder installation with a Heavy Forwarder.

0 Karma

dkeck
Influencer

HI,

is /var/log/cron the source which is displayed with this events? Could it be that it is /var/log/cron.log

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...