Getting Data In

How to filter few lines from an event in splunk

poddraj
Explorer

Hi all,
I am new to splunk and am facing issue while trying to filter lines which has "Dequeue" in the event. I want the lines with Dequeue to be removed from the event before indexing. Below is my transforms.conf which is moving the entire event into nullQueue instead to remove only that line which has Dequeue in it.

[Dequeue]
REGEX = (?m)^(.*Dequeue.*)
DEST_KEY = queue
FORMAT = nullQueue

Sample Event:

|HEM
FTTP
TEST
DTI_EXPRESS
10-118-224-197.ebiz.verizon.com
VOICE
2019-11-27T10:32:00Z
Y
Y
Y
1
5.0
YES
76000001
/CTLHDR
/REQUEST
VOICE
YES
GETCSD
CHELLPA
M
M

 8454255242

YYYYNYYYNNYYYYYNNNYNNNNYNNNYNNYYYYYYYNYYYYYYYYYYYYYYNNNNYNYYYYYYYYYYYYYYYYYYYYYY
Y
/REQUEST
/DELPHI_REQUEST
    11/28 14:36:16.75 ft_acce(19692)874  QueueCommand: DTE_KEY: SID:A391000000-, WPID:76000001, COMMAND:GET-CSD2, FT:INVALID_FT, REQID:391000000, PRIORITY:Default, TIMEOUT:1 sec
    11/28 14:36:16.75 priorit(19692)497  Dequeue: Entry
0 Karma
1 Solution

woodcock
Esteemed Legend

You are using the wrong approach. Use this instead:

SEDCMD-dequeue = s/(?m)^(.*Dequeue.*)//g

View solution in original post

0 Karma

woodcock
Esteemed Legend

You are using the wrong approach. Use this instead:

SEDCMD-dequeue = s/(?m)^(.*Dequeue.*)//g
0 Karma

poddraj
Explorer

My transforms.conf is:

[Dequeue]
REGEX = (?m)^(.*Dequeue.*)
DEST_KEY = queue
FORMAT = nullQueue

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...