https://community.splunk.com/t5/Getting-Data-In/filter-event-app-not-taking-effect/m-p/76116#M15545 <P>i entered the wrong source name. <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Wed, 22 Feb 2012 00:40:46 GMT tven 2012-02-22T00:40:46Z https://community.splunk.com/t5/Getting-Data-In/filter-event-app-not-taking-effect/m-p/76115#M15544 <P>my goal is to eliminate the following event from being indexed as it is killing our license.</P> <PRE><CODE>Could not ungzip\. Heartbeat will not be working\. Unexpected end of ZLIB input stream </CODE></PRE> <P>So i created filterEventApp/local under /opt/splunk/etc/apps on all our indexers and created a props.conf and transforms.conf files under them</P> <P>props.conf</P> <PRE><CODE> [source::/opt/liferay/.../apache-tomcat-7.0.21/logs/http.log*] TRANSFORMS-set=setnull </CODE></PRE> <P>transforms.conf</P> <PRE><CODE>[setnull] REGEX = Could not ungzip\. Heartbeat will not be working\. Unexpected end of ZLIB input stream DEST_KEY = queue FORMAT = nullQueue </CODE></PRE> <P>But after restarting indexers, i still see these events being indexed. Wondering if there is anything wrong with my approach.</P> <P>2nd qq, will the filtering be triggered for only the specified source?</P> Wed, 22 Feb 2012 00:01:25 GMT https://community.splunk.com/t5/Getting-Data-In/filter-event-app-not-taking-effect/m-p/76115#M15544 tven 2012-02-22T00:01:25Z https://community.splunk.com/t5/Getting-Data-In/filter-event-app-not-taking-effect/m-p/76116#M15545 <P>i entered the wrong source name. <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Wed, 22 Feb 2012 00:40:46 GMT https://community.splunk.com/t5/Getting-Data-In/filter-event-app-not-taking-effect/m-p/76116#M15545 tven 2012-02-22T00:40:46Z