/opt/splunk/etc/system/local/transforms.conf
[WhirlpoolMWGBad]
REGEX=200
DEST_KEY=queue
FORMAT=nullQueue
/opt/splunk/etc/system/local/props.conf
[WhirlpoolMWGLog]
NO_BINARY_CHECK = 1
SHOULD_LINEMERGE = false
pulldown_type = 1
TRANSFORMS-WhirlpoolMGWBad = WhirlpoolMGWBad
splunkd is restarted.
lines containing '200' should not get indexed, but they are still getting indexed. What am I missing?
You have a transform name mismatch between your props.conf and transforms.conf. In props.conf you call the transform "WhirlpoolMGWBad" whereas you call the transform "WhirlpoolMWGBad" (you've switched the W and G) in transforms.conf.
You have a transform name mismatch between your props.conf and transforms.conf. In props.conf you call the transform "WhirlpoolMGWBad" whereas you call the transform "WhirlpoolMWGBad" (you've switched the W and G) in transforms.conf.
d'oh! must have looked at that 5 times. Thank you for that.
is there a way to change the logging levels so that Splunk will log if a non-existent stanza is referenced?
Have you made sure the props and transforms are on all of your indexers? For Nullqueue work it needs to be on the indexers receiving the events.
Does your sourcetype match exactly?
Can you post your sample log event?