I am using pattern base indexing like below that is if i have splunk_send and app host in event i m trying to discard the event. which is working some times and sometimes it is not working.
using below props and transforms files
```
######more props.conf
[source::OCP]
SHOULD_LINEMERGE = false
TRUNCATE = 0
MAX_DAYS_AGO = 10000
TRANSFORMS-viprouting = customer3
######more transforms.conf
[customer3]
REGEX = (?s)(splunk_send).+?(xxxxx-app-c0[0-9]?\.abc\.abc\.cde\.fgh\.com)
FORMAT = nullQueue
DEST_KEY = queue
```
do we have any limitation on length of the event or anything else?
Please help me
Probably add
LOOKAHEAD = <something bigger than 4096>
https://docs.splunk.com/Documentation/Splunk/latest/Admin/Transformsconf
LOOKAHEAD = <integer>
* NOTE: This option is valid for all index time transforms, such as
index-time field creation, or DEST_KEY modifications.
* Optional. Specifies how many characters to search into an event.
* Default: 4096
* You may want to increase this value if you have event line lengths that
exceed 4096 characters (before linebreaking).
Hi vasanthi77,
can you share an example of not discarded logs?
Bye.
Giuseppe