- Splunk Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Why is nullQueue configuration not working?
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
/opt/splunk/etc/system/local/transforms.conf
[WhirlpoolMWGBad]
REGEX=200
DEST_KEY=queue
FORMAT=nullQueue
/opt/splunk/etc/system/local/props.conf
[WhirlpoolMWGLog]
NO_BINARY_CHECK = 1
SHOULD_LINEMERGE = false
pulldown_type = 1
TRANSFORMS-WhirlpoolMGWBad = WhirlpoolMGWBad
splunkd is restarted.
lines containing '200' should not get indexed, but they are still getting indexed. What am I missing?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You have a transform name mismatch between your props.conf and transforms.conf. In props.conf you call the transform "WhirlpoolMGWBad" whereas you call the transform "WhirlpoolMWGBad" (you've switched the W and G) in transforms.conf.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You have a transform name mismatch between your props.conf and transforms.conf. In props.conf you call the transform "WhirlpoolMGWBad" whereas you call the transform "WhirlpoolMWGBad" (you've switched the W and G) in transforms.conf.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
d'oh! must have looked at that 5 times. Thank you for that.
is there a way to change the logging levels so that Splunk will log if a non-existent stanza is referenced?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Have you made sure the props and transforms are on all of your indexers? For Nullqueue work it needs to be on the indexers receiving the events.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Does your sourcetype match exactly?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Can you post your sample log event?
Announcing Scheduled Export GA for Dashboard Studio
Extending Observability Content to Splunk Cloud
More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!
