Hi,
I have a logfile with a bunch of hosts, but I only want to index certain hosts and throw the rest away. How would I do this?
Create a regex that matches the hosts you want to index data from and send the rest of the events to the nullQueue. http://docs.splunk.com/Documentation/Splunk/5.0.1/Deploy/Routeandfilterdatad#Keep_specific_events_an...
Create a regex that matches the hosts you want to index data from and send the rest of the events to the nullQueue. http://docs.splunk.com/Documentation/Splunk/5.0.1/Deploy/Routeandfilterdatad#Keep_specific_events_an...
Never mind - brain fart! All set.
Is the [source] stanza actually inputs.conf or did you put it in props.conf?
I tried following the doc, and I keep getting a possible typo error. I can't find the problem.
inputs.conf:
[monitor:///usr/local/nsmutils/varlog/ncosyslog.log]
disabled = false
followTail = 0
index= throwaway
sourcetype = euc_syslogdata
[source::/usr/local/nsmutils/varlog/ncosyslog.log]
TRANSFORMS-set=setnull,setparsing
transforms.conf:
[setnull]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue
[setparsing]
REGEX = [vc-]
DEST_KEY = queue
FORMAT = indexQueue
Exactly what I'm looking for! Thanks.