https://community.splunk.com/t5/Getting-Data-In/Why-is-my-nullQueue-configuration-in-inputs-conf-and-transforms/m-p/217022#M42706 <P>Hello Splunkers!</P> <P>I am having difficulties with my nullQueue configuration when trying to exclude rows with JS, CSS, and images. <BR /> Trying the regex in the Splunk search works fine, but the events are still indexed by Splunk.<BR /> My setup is a single Splunk instance and the conf files are in /etc/system/local.</P> <P>Inputs.conf</P> <PRE><CODE>[monitor://C:\Users\admin\Desktop\test.log] disabled = false host = bla sourcetype = Transform_Test TRANSFORMS-null= setnull </CODE></PRE> <P>Transforms.conf</P> <PRE><CODE>[setnull] REGEX = (?m)^.*(gif|css|js|jpg|png|ico)\s.*$ DEST_KEY = queue FORMAT = nullQueue </CODE></PRE> <P>What to exclude:</P> <PRE><CODE>192.168.1.3 - - [09/Sep/2015:09:35:46 +0200] "GET /work/js/abc.js HTTP/1.1" 200 41162 392 192.168.1.3 - - [09/Sep/2015:09:35:46 +0200] "GET /work/images/test.gif HTTP/1.0" 200 135 20 </CODE></PRE> <P>What to include:</P> <PRE><CODE>192.168.1.3 - - [09/Sep/2015:09:35:44 +0200] "POST /bla/abc.jsp?target=layout!ba!searchForm&amp;eventName=Search HTTP/1.1" 200 184359 1832621 </CODE></PRE> <P>When changing the regex to <CODE>\[sshd\]</CODE> and make an event <CODE>[sshd]</CODE> in the logfile, the event isn't excluded as well. So it doesn't look like an problem with the regex.</P> <P>Does someone have any idea?</P> Wed, 09 Sep 2015 10:00:03 GMT BBakkenes 2015-09-09T10:00:03Z https://community.splunk.com/t5/Getting-Data-In/Why-is-my-nullQueue-configuration-in-inputs-conf-and-transforms/m-p/217022#M42706 <P>Hello Splunkers!</P> <P>I am having difficulties with my nullQueue configuration when trying to exclude rows with JS, CSS, and images. <BR /> Trying the regex in the Splunk search works fine, but the events are still indexed by Splunk.<BR /> My setup is a single Splunk instance and the conf files are in /etc/system/local.</P> <P>Inputs.conf</P> <PRE><CODE>[monitor://C:\Users\admin\Desktop\test.log] disabled = false host = bla sourcetype = Transform_Test TRANSFORMS-null= setnull </CODE></PRE> <P>Transforms.conf</P> <PRE><CODE>[setnull] REGEX = (?m)^.*(gif|css|js|jpg|png|ico)\s.*$ DEST_KEY = queue FORMAT = nullQueue </CODE></PRE> <P>What to exclude:</P> <PRE><CODE>192.168.1.3 - - [09/Sep/2015:09:35:46 +0200] "GET /work/js/abc.js HTTP/1.1" 200 41162 392 192.168.1.3 - - [09/Sep/2015:09:35:46 +0200] "GET /work/images/test.gif HTTP/1.0" 200 135 20 </CODE></PRE> <P>What to include:</P> <PRE><CODE>192.168.1.3 - - [09/Sep/2015:09:35:44 +0200] "POST /bla/abc.jsp?target=layout!ba!searchForm&amp;eventName=Search HTTP/1.1" 200 184359 1832621 </CODE></PRE> <P>When changing the regex to <CODE>\[sshd\]</CODE> and make an event <CODE>[sshd]</CODE> in the logfile, the event isn't excluded as well. So it doesn't look like an problem with the regex.</P> <P>Does someone have any idea?</P> Wed, 09 Sep 2015 10:00:03 GMT https://community.splunk.com/t5/Getting-Data-In/Why-is-my-nullQueue-configuration-in-inputs-conf-and-transforms/m-p/217022#M42706 BBakkenes 2015-09-09T10:00:03Z https://community.splunk.com/t5/Getting-Data-In/Why-is-my-nullQueue-configuration-in-inputs-conf-and-transforms/m-p/217023#M42707 <P>You don't use inputs.conf files to call transforms. You need to have a props.conf file. So, in your props.conf file you would have something to the affect of:</P> <P>[Transform_Test]<BR /> TRANSFORMS-null= setnull</P> <P>then you can leave your transforms.conf file the way it is.</P> Wed, 09 Sep 2015 12:56:06 GMT https://community.splunk.com/t5/Getting-Data-In/Why-is-my-nullQueue-configuration-in-inputs-conf-and-transforms/m-p/217023#M42707 tskinnerivsec 2015-09-09T12:56:06Z