en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en es en en en en en en de en es en en en fr ga en en en en en en en en en en en en en en en en fr en fr en fr en fr en kn en en en en en en en en en hi en es en en en en en en hbs_lat en en ko ko en ko ko ko en en en en en en en en en en en en en en en en en en en en en en en en en en de de en en en en en en en en en hi en es en en en en en en en fr ko ko ko ko ko it en en en ko en en en en en en en en en ko en en en en en en en en en en en en en en
How to Filter some row Input Data? - Splunk Community
COVID-19 Response SplunkBase Developers Documentation
Building for the Splunk Platform
Europe, Middle East and Africa
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
All communityThis categoryThis boardKnowledge baseUsers cancel
How to Filter some row Input Data?
Subscribe to RSS Feed
Mark Topic as New
Mark Topic as Read
Float this Topic for Current User
Subscribe to RSS Feed
Email to a Friend
How to Filter some row Input Data?
2015-11-27 00:02:44.277013 INFO MM_01@06472 LINEDEV = 0 , EventDEV = 223 , EVENT = TDX_PLAY (0x81)
중에 LINEDEV 라고 들어간 row 들만 제거하고 데이터를 수집할려고 합니다.
웹로그에서 이미지 파일 필터링 하는 방식으로 사용하려 했었는데 잘 안되는 것 같습니다.
적용은 U.F에 적용을 했는데 현재 인덱서 사이에 헤비포워더가 있는 환경입니다.
2015-11-27 00:02:32.756354 INFO MM_01@06472 LINEDEV = 0 , EventDEV = 223 , EVENT = TDX_PLAY (0x81)
2015-11-27 00:02:32.756354 INFO MM_01@05284 [0093] [EVENT] TDX_PLAY (106:106,0)to(-1)
2015-11-27 00:02:40.046771 INFO MM_01@06472 LINEDEV = 0 , EventDEV = 223 , EVENT = TDX_PLAY (0x81)
2015-11-27 00:02:40.046771 INFO MM_01@05284 [0093] [EVENT] TDX_PLAY (106:106,0)to(-1)
2015-11-27 00:02:44.277013 INFO MM_01@06472 LINEDEV = 0 , EventDEV = 223 , EVENT = TDX_PLAY (0x81)
2015-11-27 00:02:44.277013 INFO MM_01@05284 [0093] [EVENT] TDX_PLAY (106:106,0)to(-1)
2015-11-27 00:02:51.543429 INFO MM_01@06472 LINEDEV = 0 , EventDEV = 223 , EVENT = TDX_PLAY (0x81)
2015-11-27 00:02:51.543429 INFO MM_01@05284 [0093] [EVENT] TDX_PLAY (106:106,0)to(-1)
2015-11-27 00:02:55.773671 INFO MM_01@06472 LINEDEV = 0 , EventDEV = 223 , EVENT = TDX_PLAY (0x81)
2015-11-27 00:02:55.773671 INFO MM_01@05284 [0093] [EVENT] TDX_PLAY (106:106,0)to(-1)
2015-11-27 00:03:03.034086 INFO MM_01@06472 LINEDEV = 0 , EventDEV = 223 , EVENT = TDX_PLAY (0x81)
2015-11-27 00:03:03.034086 INFO MM_01@05284 [0093] [EVENT] TDX_PLAY (106:106,0)to(-1)
2015-11-27 00:03:03.034086 INFO MM_01@05284 [0093] [PROMPT_GETDIGIT] Result = TIMEOUT , Data = [3202] , DigitMask = [12] .
2015-11-27 00:03:03.055087 ERROR SM_01@07056 [0093] [보험.dxml][님이 맞으면 1번 아니면 2번][00000063][prompt-get-digit] End Event[timeout] Elapsed[34522ms] [Result[-2] InputDigit[] AudioFile[3202],AudioFileTimeout[C000][C000],AudioFileInvalid[C001][C001],AudioFileType[0],RetryCount[3][3],TimeoutPerDigit[5][5],DigitMask[12][12]],ClearBuffer[0],SmartIVRType[0],SmartIVRParam[][]]
2015-11-27 00:03:03.075088 INFO SM_01@07056 [0093] [3Err_HangUp.dxml][3회 오류 종료][99999999][start] End Event[ok] Elapsed[0ms] []
2015-11-27 00:03:06.424280 INFO MM_01@06472 LINEDEV = 0 , EventDEV = 223 , EVENT = TDX_PLAY (0x81)
2015-11-27 00:03:06.424280 INFO MM_01@05284 [0093] [EVENT] TDX_PLAY (106:106,0)to(-1)
2015-11-27 00:03:06.424280 INFO MM_01@05284 [0093] [PROMPT] Result = 0 , Type = [V] , Data = [C002] .
2015-11-27 00:03:06.435280 INFO SM_01@07056 [0093] [3Err_HangUp.dxml][이용방법안내][00000001][prompt] End Event[ok] Elapsed[3340ms] [AudioData[ IqGDArSrPhjh8lIpzTbUsQ== ],AudioDataFormat[V][V],BargeIn[1],AudioFileType[0],SmartIVRType[0],SmartIVRParam[][], SmartIVRLoop[0]]
2015-11-27 00:03:06.475283 INFO MM_01@06472 LINEDEV = 222 , EventDEV = 222 , EVENT = GCEV_DROPCALL (0x805)
2015-11-27 00:03:06.475283 INFO MM_01@05284 [0093] [EVENT] GCEV_DROPCALL (102:102,0)to(-1)
2015-11-27 00:03:06.475283 INFO MM_01@05284 [0093] [HANGUP_CALL] Result = 0.
2015-11-27 00:03:06.484283 INFO MM_01@06472 LINEDEV = 0 , EventDEV = 221 , EVENT = IPMEV_STOPPED (0x9003)
2015-11-27 00:03:06.495284 INFO SM_01@07056 [0093] [3Err_HangUp.dxml][전화 끊기][00000002][hangup-call] End Event[hangup] Elapsed[40ms] []
2015-11-27 00:03:06.515285 ERROR SM_01@07056 cti_call_end is not found.
Subscribe to RSS Feed
Email to a Friend
데이터를 필터링하려면 파싱이 필요한데요 유니버셜 포워더는 파싱 기능이 없습니다. 운영중인 서버에 예상치 못한 부하를 주지 않기 위해 필터링은 인덱서 쪽에하는 것이 일반적입니다. (물론 걸러진 데이터에 얼마나 중요한 정보가 있을지 모르기 때문에 필터링 하지 않는 것이 가장 좋습니다.)
만약 인덱서로 데이터를 보내기 전에 꼭 필터링하고 보내야만 하는 상황이라면 유니버셜 포워더가 아닌 헤비 포워더를 설치하고 필터링하여 보낼 수 있습니다.
유니버셜 포워더와 인덱서 중간에 헤비 포워더가 있으시니, 아래의 설정을 중간 헤비 포워더에 적용해도 됩니다만, 특별한 경우가 아니라면 중간 헤비 포워더를 두지 않는 구조가 더 견고합니다. (추가 적인 관리 문제, 데이터 지연 문제 등)
위 샘플 데이터를 수집할 때 사용하실 소스타입을 "mysourcetype"이라고 가정하고 인덱서에 props.conf와 transforms.conf 파일을 생성한 후 아래 예와 같이 설정하고 인덱서를 재시작하시면 인덱서로 저장하기 전에 필터링하실 수 있습니다.
참고로, 인덱서에서 필터링을 하더라도 필터링되는 데이터는 라이센스를 소모하지 않습니다.
Get Updates on the Splunk Community!
New Cloud Intrusion Detection System Add-on for Splunk
In July 2022 Splunk released the Cloud IDS add-on which expanded Splunk capabilities in security and data ...
Happy CX Day to our Community Superheroes!
Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...
Check out This Month’s Brand new Splunk Lantern Articles
Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...
Read our Community Blog >
Sitemap | Privacy | Website Terms of Use | Splunk Licensing Terms | Export Control | Modern Slavery Statement | Splunk Patents
© 2005-2022 Splunk Inc. All rights reserved.
Splunk, Splunk>, Turn Data Into Doing, Data-to-Everything, and D2E are trademarks or registered trademarks of Splunk Inc. in the United States and other countries. All other brand names, product names, or trademarks belong to their respective owners.