I'm trying to send certain events ("IdcServerThread" stuff) to nullQueue unless there's a specific pattern in it (the "verbose:" stuff). I'm not able to perform a positive match on all the other possibilities, so I'm trying a negative lookahead. What am I doing wrong?
KEEP LINE:
system 10.28 18:25:05.078 IdcServerThread-24 Configuring tracing verbose: false; sections: system, indexer, requestaudit
DISCARD LINE:
requestaudit 10.28 18:25:01.753 IdcServerThread-23 Ending request thread leaving behind 0 active request threads
props.conf
[source::.../*stub/etc/log]
sourcetype = stellent_log
TRANSFORMS-stellent = no_stellent_verbose
transforms.conf
[no_stellent_verbose]
REGEX = IdcServerThread-\d+\s+(?!Configuring)
DEST_KEY = queue
FORMAT = nullQueue
You can match on everything, then override it for the subset you want to keep.
Take a look at:
http://www.splunk.com/base/Documentation/4.1.5/Admin/Routeandfilterdata#Keep_specific_events_and_dis...
transforms.conf:
[stellent_setnull]
REGEX = IdcServerThread
DEST_KEY = queue
FORMAT = nullQueue
[stellent_keep]
REGEX = IdcServerThread[\d\-\s]+Configuring
DEST_KEY = queue
FORMAT = indexQueue
props.conf
[source::.../*stub/etc/log]
sourcetype = stellent_log
TRANSFORMS-stellent = stellent_setnull, stellent_keep
The indexer will set all matching events to nullQueue, but then reset the "verbose" ones back to indexQueue.
You can match on everything, then override it for the subset you want to keep.
Take a look at:
http://www.splunk.com/base/Documentation/4.1.5/Admin/Routeandfilterdata#Keep_specific_events_and_dis...
transforms.conf:
[stellent_setnull]
REGEX = IdcServerThread
DEST_KEY = queue
FORMAT = nullQueue
[stellent_keep]
REGEX = IdcServerThread[\d\-\s]+Configuring
DEST_KEY = queue
FORMAT = indexQueue
props.conf
[source::.../*stub/etc/log]
sourcetype = stellent_log
TRANSFORMS-stellent = stellent_setnull, stellent_keep
The indexer will set all matching events to nullQueue, but then reset the "verbose" ones back to indexQueue.