Getting Data In

Why is the discard of specific events not working in props.conf and transforms.conf

simpkins1958
Contributor

I am forwarding data from Splunk Enterprise on one server to Splunk Enterprise on a second server. Data is getting indexed on 2nd server as expected.

On the receiving Splunk Enterprise server I want to ignore events with source of NetMotion. I have configured props.conf and transforms.conf and placed them in C:\Program Files\Splunk\etc\system\local per instructions from http://docs.splunk.com/Documentation/Splunk/6.6.0/Forwarding/Routeandfilterdatad#Discard_specific_ev...
Can't get this working. All the data from source=NetMotion is still getting indexed on the 2nd server.

I have restarted the Splunk server.

props.conf:
[source::NetMotion]
TRANSFORMS-null= setnull

transforms.conf:
[setnull]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue
0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

The data parsing, including routing, happens on the first Splunk Enterprise instance that appears in the flow. Based on description above, it seems that your first Splunk Enterprise instance is acting as heavy forwarder and these props/transforms entries should be kept in heavy forwarder when it's used. (setup these in first Splunk Enterprise instance and restart Splunk service on it).

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

The data parsing, including routing, happens on the first Splunk Enterprise instance that appears in the flow. Based on description above, it seems that your first Splunk Enterprise instance is acting as heavy forwarder and these props/transforms entries should be kept in heavy forwarder when it's used. (setup these in first Splunk Enterprise instance and restart Splunk service on it).

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...