topic Re: Universal Forwarder + nullQueue in Getting Data In

Universal Forwarder + nullQueue

ruisantos — Fri, 15 Nov 2013 14:30:04 GMT

I'm trying to remove some of the events that should be forwarded to the frontend.
From a configuration perspective everything is OK.

transforms.conf

[nullMon]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue

[routeRemains]
REGEX = .
DEST_KEY=_TCP_ROUTING
FORMAT= tcp_out

props.conf

[source_log]
TRANSFORMS = nullMon, routeRemains

But I'm receiving everything on the destination host.
Does the Universal Forwarder allow the use of nullQueues?

kristian_kolb — Fri, 15 Nov 2013 14:38:49 GMT

No, since nullQueue tranformations take place during the parsing phase, this configuration is only valid on either a Heavy Forwarder or an Indexer.

fervin — Fri, 15 Nov 2013 14:40:52 GMT

No, you'd need to configure this transform on an indexer or heavy forwarder. See http://docs.splunk.com/Documentation/Splunk/6.0/Indexer/Howindexingworks