I am unable to remove the standard Blue Coat heades tha begin with the # comment. I have tried several iterations of the nullQueue using REGEX and SEDCMD

[babcolee]

This is a copy of the log header and how I currently have the props.conf and transforms.conf configured

Software: SGOS 6.5.9.8

Version: 1.0

Start-Date: 2016-11-10 08:19:24

Date: 2016-08-12 01:46:28

Fields: date time time-taken c-ip cs-username cs-auth-group x-exception-id sc-filter-result cs-categories cs(Referer) sc-status s-action cs-method rs(Content-Type) cs-uri-scheme cs-host cs-uri-port cs-uri-path cs-uri-query cs-uri-extension cs(User-Agent) s-ip sc-bytes cs-bytes x-virus-id x-bluecoat-application-name x-bluecoat-application-operation x-bluecoat-transaction-uuid x-icap-reqmod-header(X-ICAP-Metadata) x-icap-respmod-header(X-ICAP-Metadata)

Remark: 4111140007 "fdc-bcoat-2" "140.108.3.12" "GSOCLogFeed"

props.conf
[bluecoat:proxysg:access:syslog]
TRANSFORMS-null = TrashHeader

transforms.conf
[TrashHeader]
REGEX = ^#
DEST_KEY = queue
FORMAT = nullQueue

[Azeemering]

Late answer but maybe it will benefit someone who searches for the same in the future:
You have ^# that will discard all events that start with #
Your props and transforms look fine.

I think the main question is when do you want to discard them? At index time you need to make sure you place them on the indexers (or in etc/system/local on single install of splunk). Also make sure you restart splunk to make the settings active.

Whatever you do make sure you troubleshoot if the props and transform settings are active.
Use btool:

$SPLUNK_HOME/bin/splunk cmd btool props list

[babcolee]

Thank you for your response. Unfortunately, the Blue Coat header is still showing with the events

[gokadroid]

Can you try to replace your regex of REGEX=^# to REGEX=^#.*$ and see if it works. See here for sample.

[babcolee]

Thank you for your response. Unfortunately, the Blue Coat header is still showing with the events