topic Specific DNS queries from Splunk Stream to nullQueue in Getting Data In https://community.splunk.com/t5/Getting-Data-In/Specific-DNS-queries-from-Splunk-Stream-to-nullQueue/m-p/571502#M101209 <P>Hello everyone,&nbsp;</P><P>I have tons of DNS queries in my enterprise on commercial legit domains (eg. partnerweb.vmware.com, login.live.com) which I don't want to log with Splunk Stream. My configuration is as follows but apparently it doesn't work:</P><P>app: Splunk_TA_stream_wire_data</P><P><STRONG>props.conf<BR /></STRONG></P><LI-CODE lang="markup">[streamfwd://streamfwd] TRANSFORMS-blacklist-vmwarecom = vmware.com</LI-CODE><P><STRONG>transforms.conf<BR /></STRONG></P><LI-CODE lang="markup">[vmware.com] REGEX=query\=partnerweb\.vmware\.com DEST_KEY=queue FORMAT=nullQueue</LI-CODE><P><BR />Any help would be appreciated.</P><P>Kind regards,</P><P>Chris</P><P>&nbsp;</P> Tue, 19 Oct 2021 12:26:36 GMT b_chris21 2021-10-19T12:26:36Z Specific DNS queries from Splunk Stream to nullQueue https://community.splunk.com/t5/Getting-Data-In/Specific-DNS-queries-from-Splunk-Stream-to-nullQueue/m-p/571502#M101209 <P>Hello everyone,&nbsp;</P><P>I have tons of DNS queries in my enterprise on commercial legit domains (eg. partnerweb.vmware.com, login.live.com) which I don't want to log with Splunk Stream. My configuration is as follows but apparently it doesn't work:</P><P>app: Splunk_TA_stream_wire_data</P><P><STRONG>props.conf<BR /></STRONG></P><LI-CODE lang="markup">[streamfwd://streamfwd] TRANSFORMS-blacklist-vmwarecom = vmware.com</LI-CODE><P><STRONG>transforms.conf<BR /></STRONG></P><LI-CODE lang="markup">[vmware.com] REGEX=query\=partnerweb\.vmware\.com DEST_KEY=queue FORMAT=nullQueue</LI-CODE><P><BR />Any help would be appreciated.</P><P>Kind regards,</P><P>Chris</P><P>&nbsp;</P> Tue, 19 Oct 2021 12:26:36 GMT https://community.splunk.com/t5/Getting-Data-In/Specific-DNS-queries-from-Splunk-Stream-to-nullQueue/m-p/571502#M101209 b_chris21 2021-10-19T12:26:36Z