Filtering and routing

Filtering and routing

Set up Splunk to filter out unwanted events before forwarding and indexing. Edit props.conf and transforms.conf on the forwarding side to eliminate unnecessary data before forwarding. Use the $SPLUNK_HOME/etc/bundles/README/props.conf.example and ../transforms.conf.example as examples, or create your own props.conf and transforms.conf. Make any changes in $SPLUNK_HOME/etc/bundles/local/, or your own custom bundle directory. For more information on configuration files in general, see how configuration files work.

Note: You must set up this configuration on the Splunk instance that handles the parsing. Depending on your configuration, this may be the either the indexer or the forwarder instance.

Configuration

In order to filter out specific events:

1. create a regex in transforms.conf that sends the events that match to the null queue.

1. create an entry in props.conf that calls the appropriate transform.

transforms.conf

In $SPLUNK_HOME/etc/bundles/local/transforms.conf add the following stanza:

[$UNIQUE_STANZA_NAME]
REGEX = $YOUR_CUSTOM_REGEX
DEST_KEY = queue
FORMAT = nullQueue

$YOUR_CUSTOM_REGEX should specify the key term that identifies the events you want to remove.

Leave DEST_KEY and FORMAT with the above values to send identified events to the nullQueue (eg delete them before indexing).

props.conf

In $SPLUNK_HOME/etc/bundles/local/props.conf add the following stanza:

[<spec>]
TRANSFORMS-$name=$UNIQUE_STANZA_NAME

<spec> can be:

1. <sourcetype>, the sourcetype of an event
2. host::<host>, where <host> is the host for an event
3. source::<source>, where <source> is the source for an event

{$name}} is whatever unique identifier you want to give to your transform.

$UNIQUE_STANZA_NAME must match the stanza name of the transform you just created in transforms.conf.

Example

This example removes unwanted events such as "Last message repeated n times."

transforms.conf

[nullQueueRegex]
REGEX = Last message repeated
DEST_KEY = queue
FORMAT = nullQueue

props.conf

[source::/var/log/splunk/syslog-ng/vmware.log]
TRANSFORMS-vmwarefilter = nullQueueRegex

• Was this topic useful?
• Post a comment