topic Send all Logmessages witch contain DEBUG to /dev/null on splunkforwarder-6.0.3-204106-AIX-powerpc in Getting Data In

Send all Logmessages witch contain DEBUG to /dev/null on splunkforwarder-6.0.3-204106-AIX-powerpc

pit4getit — Wed, 21 May 2014 14:52:38 GMT

Cant get DEBUG messages filtered out at all on splunkforwarder.

Did create $SPLUNKHOME/etc/system/local/transforms.conf

[debug-setnull]
REGEX = DEBUG
DEST_KEY = queue
FORMAT = nullQueue

Did copy props.conf drom default to $SPLUNKHOME/etc/system/local/props.conf

[source::.../*.log]
TRANSFORMS = debug-setnull

restarted splunkforwarder

Result: Still get DEBUG Messages sent to Splunkserver.
Don't know whi it not works. Does forwarder works not with transforms.conf?

if run check debug, get following message.
splunk btool check –debug
 -> No spec file for: /usr/local/splunk/splunkforwarder/etc/system/local/transforms.conf

Thanks for help
Peter

Re: Send all Logmessages witch contain DEBUG to /dev/null on splunkforwarder-6.0.3-204106-AIX-powerpc

jameshgibson — Wed, 21 May 2014 15:13:55 GMT

You need to set this up on the indexer not the forwarder as that's where these rules are applied.

Re: Send all Logmessages witch contain DEBUG to /dev/null on splunkforwarder-6.0.3-204106-AIX-powerpc

pit4getit — Wed, 21 May 2014 15:19:56 GMT

Thanks works when is configured at indexer.