Splunk Search

How to escape the first line having ‘null’ char

sumanbej
New Member

I have a log file ( generated from the WAS server) having the first line like that :
null null null null...
Please help me how to excape that line from the Splunk conf files.

Tags (1)
0 Karma

okrabbe_splunk
Splunk Employee
Splunk Employee

I imagine you wan't to discard the first line because it does not have useful date.

Please see this link on how to filter data out to the null queue. You would need to create a regular expression to match the line you want to remove.

http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Routeandfilterdatad#Filter_event_data_and_...

0 Karma

shaileshv02
Explorer

"Escape the first line" means the first line of the file contains binary data
Configs:
inputs.conf
[monitor://C:\AEP]
disabled = false
followTail = 0
index = main
sourcetype = log4j
CRCSALT =

props.conf
[log4j]
NO_BINARY_CHECK = True
TRUNCATE = 100000
[source::C:\AEP]
sourcetype = log4j
TRANSFORMS-null= setnull

transforms.conf
[setnull]
REGEX = [\x00]
DEST_KEY = queue
FORMAT = nullQueue

Getting following error.
Access error while handling path: failed to open for checksum: 'C:\AEP\bw-timer-mm.log.3' (The process cannot access the file because it is being used by another process.)

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

What do you mean by "escape the first line"?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...