Knowledge Management

Collect specific rows of a trace file

avitallange
Explorer

Hi,

Is it possible to collect specific rows of a trace file?

I have one trace file that contains Info traces and Error traces.
I'd like Splunk to collect only the error lines.

For example, below are 2 rows in the trace file:

Time: 07/31/2013 10:35:30, Content: MyInfoMessage, Severity: Information

Time: 07/31/2013 10:45:30, Content: MyInfoMessage, Severity: Error

I'd like to collect with Splunk the second line only, the one that contains "Severity: Error"

Is thre any idea how to do this?

Tags (2)
0 Karma

sowings
Splunk Employee
Splunk Employee

The usual way to do this would be to prompt Splunk to drop the messages that are "Severity: Information". This is done with a parse-time transform to set the _queue metadata field for that event to nullQueue. An example is shown below. The assumption is that your sourcetype for the data is "my_sourcetype".

props.conf


[my_sourcetype]
TRANSFORMS-0_null_queue = drop_information_messages

transforms.conf


[drop_information_messages]
REGEX = Severity:\sInformation
DEST_KEY = queue
FORMAT = nullQueue

See transforms.conf and look for nullQueue.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...