Hello,
I am trying to setup a nullQueue for Windows security events we do not care to index into Splunk and my configuration is not working. I am using the below on the Indexer and restarted Splunk. I do not see any errors and I am not sure how else to troubleshoot the issue. The sourcetype in the props matches the sourcetype of the data. Any feedback is most appreciated.
props.conf
[WinEventLog:Security]
TRANSFORMS-WinEvents=eliminate-eventcodes
transforms.conf
[eliminate-eventcodes]
REGEX = EventCode=(5156|4656|33205|5158|577|578|5157|5145|4769|4768|5145|4634)
DEST_KEY = queue
FORMAT = nullQueue
Try...
props.conf
[WinEventLog:Security]
TRANSFORMS-DiscardWinEvents = eliminate-eventcodes
transforms.conf
[eliminate-eventcodes]
REGEX = (?m)^EventCode=(5156|4656|33205|5158|577|578|5157|5145|4769|4768|5145|4634)
DEST_KEY = queue
FORMAT = nullQueue
You'll need to restart your indexer again after making the change.
No joy - I made the change and then restarted splunkd. The events are still being indexed. I have other data getting dumped to nullqeueu so this not working is confusing.
if you are using an Universal/Lightweight forwarder, then the nullQueue props/transforms have to be on the indexers.
But if you re using heavy forwarders (HF), you need to put the props/transforms have to to be on the HF.
otherwise since splunk 5, you can filter evencodes directly on the forwarders in the inputs.con (look for blacklist under WinEventcode)
the settings are on the indexers - I am working with support on the issue - Thanks for the suggestions
Could email me a ./splunk diag from your forwarder and your indexer? (See e-mail address in my portfolio)