Hi all,
I am new to splunk and am facing issue while trying to filter lines which has "Dequeue" in the event. I want the lines with Dequeue to be removed from the event before indexing. Below is my transforms.conf which is moving the entire event into nullQueue instead to remove only that line which has Dequeue in it.
[Dequeue]
REGEX = (?m)^(.*Dequeue.*)
DEST_KEY = queue
FORMAT = nullQueue
Sample Event:
|HEM
FTTP
TEST
DTI_EXPRESS
10-118-224-197.ebiz.verizon.com
VOICE
2019-11-27T10:32:00Z
Y
Y
Y
1
5.0
YES
76000001
/CTLHDR
/REQUEST
VOICE
YES
GETCSD
CHELLPA
M
M
8454255242
YYYYNYYYNNYYYYYNNNYNNNNYNNNYNNYYYYYYYNYYYYYYYYYYYYYYNNNNYNYYYYYYYYYYYYYYYYYYYYYY
Y
/REQUEST
/DELPHI_REQUEST
11/28 14:36:16.75 ft_acce(19692)874 QueueCommand: DTE_KEY: SID:A391000000-, WPID:76000001, COMMAND:GET-CSD2, FT:INVALID_FT, REQID:391000000, PRIORITY:Default, TIMEOUT:1 sec
11/28 14:36:16.75 priorit(19692)497 Dequeue: Entry
You are using the wrong approach. Use this instead:
SEDCMD-dequeue = s/(?m)^(.*Dequeue.*)//g
You are using the wrong approach. Use this instead:
SEDCMD-dequeue = s/(?m)^(.*Dequeue.*)//g
My transforms.conf is:
[Dequeue]
REGEX = (?m)^(.*Dequeue.*)
DEST_KEY = queue
FORMAT = nullQueue