https://community.splunk.com/t5/Getting-Data-In/How-to-drop-event-comming-from-host-template/m-p/358747#M65478 <P>Hello,<BR /> I have to drop all events received from hosts named template*</P> <P>I have created an app on indexer with the following files:</P> <P><CODE>local/app.conf</CODE></P> <PRE><CODE>[install] is_configured = 1 [ui] is_visible = 0 label = NoTemplate [launcher] author = moi description = ignore les events qui proviennent des hosts template* version = 0.0 </CODE></PRE> <P><CODE>local/props.conf</CODE></P> <PRE><CODE>[host::template...] TRANSFORMS-template = drop_templates </CODE></PRE> <P><CODE>local/transforms.conf</CODE></P> <PRE><CODE>[drop_templates] REGEX = . DEST_KEY=queue FORMAT=nullQueue </CODE></PRE> <P>Events from host <CODE>template-rh-7t</CODE>still indexed !?</P> <P>I also try with stanza <CODE>host::template*]</CODE></P> <P>Any idee ?</P> <P>Thanks<BR /> Christian</P> Tue, 08 Aug 2017 12:22:06 GMT ktn01 2017-08-08T12:22:06Z https://community.splunk.com/t5/Getting-Data-In/How-to-drop-event-comming-from-host-template/m-p/358747#M65478 <P>Hello,<BR /> I have to drop all events received from hosts named template*</P> <P>I have created an app on indexer with the following files:</P> <P><CODE>local/app.conf</CODE></P> <PRE><CODE>[install] is_configured = 1 [ui] is_visible = 0 label = NoTemplate [launcher] author = moi description = ignore les events qui proviennent des hosts template* version = 0.0 </CODE></PRE> <P><CODE>local/props.conf</CODE></P> <PRE><CODE>[host::template...] TRANSFORMS-template = drop_templates </CODE></PRE> <P><CODE>local/transforms.conf</CODE></P> <PRE><CODE>[drop_templates] REGEX = . DEST_KEY=queue FORMAT=nullQueue </CODE></PRE> <P>Events from host <CODE>template-rh-7t</CODE>still indexed !?</P> <P>I also try with stanza <CODE>host::template*]</CODE></P> <P>Any idee ?</P> <P>Thanks<BR /> Christian</P> Tue, 08 Aug 2017 12:22:06 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-drop-event-comming-from-host-template/m-p/358747#M65478 ktn01 2017-08-08T12:22:06Z https://community.splunk.com/t5/Getting-Data-In/How-to-drop-event-comming-from-host-template/m-p/358748#M65479 <P>your pattern in the props stanza name <BR /> [host::template...]<BR /> matches hostnames 'template' followed by exactly 3 more arbitrary chars. </P> <P>You should use something like<BR /> [host::template.*]<BR /> this matches template followed by an arbitrary number of arbitrary chars. Just be careful, this matches anything which starts with template.</P> Tue, 08 Aug 2017 13:37:06 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-drop-event-comming-from-host-template/m-p/358748#M65479 FritzWittwer_ol 2017-08-08T13:37:06Z