Hi All,
Does anyone knows a way to automatically reject data when Splunk could not identify event timestamp ?
My goal is to radically prevent inconsistent data to be indexed, if the timestamp could not be identified then this should be considered as an anomaly and the data would be sent to nullqueue (for example) instead of being indexed.
Is that possible ?
Thanks for your help
Guilhem
You can create 2 transforms to apply to your data in this order :
Read this guide "Keep_specific_events_and_discard_the_rest"
http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad#Keep_specific_even... can add a nullQueue filter that looks for a particular pattern of timestamp, and drop the events it's missing one.
PS : it will happen after the linebreaking and event merging.
You can create 2 transforms to apply to your data in this order :
Read this guide "Keep_specific_events_and_discard_the_rest"
http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad#Keep_specific_even... can add a nullQueue filter that looks for a particular pattern of timestamp, and drop the events it's missing one.
PS : it will happen after the linebreaking and event merging.
Hi Yann,
Thanks, that's in deed the way to proceed