https://community.splunk.com/t5/Getting-Data-In/Cannot-filter-WMI-events-to-nullQueue-in-4-2-x/m-p/27160#M4516 <P>In 4.0.x and 4.1.x the stanza in props.conf had to be [wmi] </P> <P>With 4.2.x you must use the actual sourcetype name.<BR /><BR /> For example:<BR /><BR /> [WMI:WinEventLog:Security]<BR /><BR /> TRANSFORMS-send2nullq= wmi2nullQ</P> Tue, 14 Jun 2011 05:27:13 GMT Ellen 2011-06-14T05:27:13Z https://community.splunk.com/t5/Getting-Data-In/Cannot-filter-WMI-events-to-nullQueue-in-4-2-x/m-p/27159#M4515 <P>I am sending some events to the nullQueue and it used to work in 4.0.x and 4.1.x, but now it is not sending any events to nullQueue. I have the following configuration:</P> <PRE><CODE>props.conf [wmi] TRANSFORMS-nuke=wmi2nullQ transforms.conf [wmi2nullQ] REGEX=(?im)(CategoryString=Logoff)[^$]+\s+(EventIdentifier=4634) DEST_KEY = queue FORMAT = nullQueue </CODE></PRE> <P>Why does this no longer work? Nothing has changed since applying a newer 4.2.x release. </P> Tue, 14 Jun 2011 05:25:22 GMT https://community.splunk.com/t5/Getting-Data-In/Cannot-filter-WMI-events-to-nullQueue-in-4-2-x/m-p/27159#M4515 Ellen 2011-06-14T05:25:22Z https://community.splunk.com/t5/Getting-Data-In/Cannot-filter-WMI-events-to-nullQueue-in-4-2-x/m-p/27160#M4516 <P>In 4.0.x and 4.1.x the stanza in props.conf had to be [wmi] </P> <P>With 4.2.x you must use the actual sourcetype name.<BR /><BR /> For example:<BR /><BR /> [WMI:WinEventLog:Security]<BR /><BR /> TRANSFORMS-send2nullq= wmi2nullQ</P> Tue, 14 Jun 2011 05:27:13 GMT https://community.splunk.com/t5/Getting-Data-In/Cannot-filter-WMI-events-to-nullQueue-in-4-2-x/m-p/27160#M4516 Ellen 2011-06-14T05:27:13Z