https://community.splunk.com/t5/Splunk-Enterprise/Filtering-the-events-using-transforms/m-p/576934#M10855 <P>Hi,</P><P>I am trying to filter the events using LOGIN keyword and drop remaining events. I am trying with the below configuration and it is not working. Any suggestions please?</P><P>props.conf</P><P>[test_sourcetype]</P><P>TRANSFORMS-sample = test_authlog,setnull_test</P><P>&nbsp;</P><P>transforms.conf</P><P>[test_authlog]</P><P>REGEX = (LOGIN)</P><P>DEST_KEY = queue</P><P>FORMAT = indexQueue</P><P>&nbsp;</P><P>[setnull_test]</P><P>REGEX = (?!LOGIN)</P><P>DEST_KEY = queue</P><P>FORMAT = nullQueue</P> Wed, 01 Dec 2021 18:44:47 GMT vihar254 2021-12-01T18:44:47Z https://community.splunk.com/t5/Splunk-Enterprise/Filtering-the-events-using-transforms/m-p/576934#M10855 <P>Hi,</P><P>I am trying to filter the events using LOGIN keyword and drop remaining events. I am trying with the below configuration and it is not working. Any suggestions please?</P><P>props.conf</P><P>[test_sourcetype]</P><P>TRANSFORMS-sample = test_authlog,setnull_test</P><P>&nbsp;</P><P>transforms.conf</P><P>[test_authlog]</P><P>REGEX = (LOGIN)</P><P>DEST_KEY = queue</P><P>FORMAT = indexQueue</P><P>&nbsp;</P><P>[setnull_test]</P><P>REGEX = (?!LOGIN)</P><P>DEST_KEY = queue</P><P>FORMAT = nullQueue</P> Wed, 01 Dec 2021 18:44:47 GMT https://community.splunk.com/t5/Splunk-Enterprise/Filtering-the-events-using-transforms/m-p/576934#M10855 vihar254 2021-12-01T18:44:47Z