https://community.splunk.com/t5/Getting-Data-In/How-to-customize-nullqueue-and-indexqueue-filtering-with-new/m-p/178024#M35693 <P>Okay, thanks Strive.</P> Wed, 27 Aug 2014 04:51:12 GMT meenal901 2014-08-27T04:51:12Z https://community.splunk.com/t5/Getting-Data-In/How-to-customize-nullqueue-and-indexqueue-filtering-with-new/m-p/178022#M35691 <P>Hi,<BR /> I have a scenario like this: I want to filter data using NullQueue and IndexQueue. I also have the patterns with me. But there is a high possibility that the new patterns may be added to this list for filtering. Now if I put it in indexer (props.conf+transforms.conf), won't I have to re-index complete data everytime? Is there an alternate solution? How does this work in Heavy Forwarder?</P> <P>Thanks,<BR /> Meenal</P> Mon, 11 Aug 2014 16:43:35 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-customize-nullqueue-and-indexqueue-filtering-with-new/m-p/178022#M35691 meenal901 2014-08-11T16:43:35Z https://community.splunk.com/t5/Getting-Data-In/How-to-customize-nullqueue-and-indexqueue-filtering-with-new/m-p/178023#M35692 <P>The old data that was indexed already cannot be changed. The new patterns will be applied to any new data that is coming in.</P> Mon, 11 Aug 2014 17:48:54 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-customize-nullqueue-and-indexqueue-filtering-with-new/m-p/178023#M35692 strive 2014-08-11T17:48:54Z https://community.splunk.com/t5/Getting-Data-In/How-to-customize-nullqueue-and-indexqueue-filtering-with-new/m-p/178024#M35693 <P>Okay, thanks Strive.</P> Wed, 27 Aug 2014 04:51:12 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-customize-nullqueue-and-indexqueue-filtering-with-new/m-p/178024#M35693 meenal901 2014-08-27T04:51:12Z