https://community.splunk.com/t5/Getting-Data-In/Applying-NullQueue-REGEX-to-ALL-sources/m-p/54442#M10537 <P>If this is really what you want to do, you can put it under the <CODE>[default]</CODE> stanza in <CODE>$SPLUNK_HOME/etc/system/local/props.conf</CODE>. This should cause your TRANSFORMS rule to fire for everything.</P> <P>I am concerned it could wind up being overzealous, though. If your regex matches on just the word "DEBUG", it has a lot of chances for false positives and will also hit Splunk's <CODE>_internal</CODE> index. Before doing this in production, test test test... </P> Thu, 19 Jan 2012 12:14:39 GMT dwaddle 2012-01-19T12:14:39Z https://community.splunk.com/t5/Getting-Data-In/Applying-NullQueue-REGEX-to-ALL-sources/m-p/54441#M10536 <P>Hi Guys - </P> <P>I'm trying to remove "DEBUG" messages from ALL inputs. What do I put in props.conf to apply a transform to all incoming data - or am I going about this wrong?</P> <P>Thanks!<BR /> -Mike</P> Thu, 19 Jan 2012 09:14:00 GMT https://community.splunk.com/t5/Getting-Data-In/Applying-NullQueue-REGEX-to-ALL-sources/m-p/54441#M10536 tewner 2012-01-19T09:14:00Z https://community.splunk.com/t5/Getting-Data-In/Applying-NullQueue-REGEX-to-ALL-sources/m-p/54442#M10537 <P>If this is really what you want to do, you can put it under the <CODE>[default]</CODE> stanza in <CODE>$SPLUNK_HOME/etc/system/local/props.conf</CODE>. This should cause your TRANSFORMS rule to fire for everything.</P> <P>I am concerned it could wind up being overzealous, though. If your regex matches on just the word "DEBUG", it has a lot of chances for false positives and will also hit Splunk's <CODE>_internal</CODE> index. Before doing this in production, test test test... </P> Thu, 19 Jan 2012 12:14:39 GMT https://community.splunk.com/t5/Getting-Data-In/Applying-NullQueue-REGEX-to-ALL-sources/m-p/54442#M10537 dwaddle 2012-01-19T12:14:39Z https://community.splunk.com/t5/Getting-Data-In/Applying-NullQueue-REGEX-to-ALL-sources/m-p/54443#M10538 <P>Thanks!!!!</P> Thu, 19 Jan 2012 12:18:39 GMT https://community.splunk.com/t5/Getting-Data-In/Applying-NullQueue-REGEX-to-ALL-sources/m-p/54443#M10538 tewner 2012-01-19T12:18:39Z