https://community.splunk.com/t5/Getting-Data-In/How-to-setup-a-filter-to-drop-specific-events-on-the-heavy/m-p/414408#M73301 <P>No.. it's only required on the instance where events go through parsingQueue (which is HF in your case).</P> Fri, 12 Apr 2019 19:14:05 GMT somesoni2 2019-04-12T19:14:05Z https://community.splunk.com/t5/Getting-Data-In/How-to-setup-a-filter-to-drop-specific-events-on-the-heavy/m-p/414405#M73298 <P>Hello, I'm trying to setup a filter to drop specific events that contain an event name from AWS. I've read through the splunk docs and the process seems straight forward:</P> <P>On the HF where I am getting my input for AWS logs I've made the updates to the props.conf and transforms.conf file like so:</P> <P>props.conf</P> <PRE><CODE>[aws] TRANSFORMS-set_null = to_null </CODE></PRE> <P>transforms.conf</P> <PRE><CODE>[to_null] REGEX = eventname DEST_KEY = queue FORMAT = nullQueue </CODE></PRE> <P>I did not list my regex in this example as I don't feel this is the issue (I've verified the expression works outside of splunk against the raw events). </P> <P>Is there something else I am missing here? As a pre-caution ive also added the above files to my indexers, but am still seeing the events in question.</P> Fri, 12 Apr 2019 14:41:31 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-setup-a-filter-to-drop-specific-events-on-the-heavy/m-p/414405#M73298 arlombar1 2019-04-12T14:41:31Z https://community.splunk.com/t5/Getting-Data-In/How-to-setup-a-filter-to-drop-specific-events-on-the-heavy/m-p/414406#M73299 <P>This configuration should be in first SplunkEnterprise instance that comes in your data flow, which I assume is your heavy forwarder. Did you restart Splunk on your HF after making this configuration change? Also, make sure the sourcetype name is correct. </P> Fri, 12 Apr 2019 16:20:50 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-setup-a-filter-to-drop-specific-events-on-the-heavy/m-p/414406#M73299 somesoni2 2019-04-12T16:20:50Z https://community.splunk.com/t5/Getting-Data-In/How-to-setup-a-filter-to-drop-specific-events-on-the-heavy/m-p/414407#M73300 <P>Looks to be working now, I must of forgot to restart splunkd on the HF. Do I need to have the same props/transforms on the indexers as well? Just trying to clean up where I can.</P> Fri, 12 Apr 2019 18:31:00 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-setup-a-filter-to-drop-specific-events-on-the-heavy/m-p/414407#M73300 arlombar1 2019-04-12T18:31:00Z https://community.splunk.com/t5/Getting-Data-In/How-to-setup-a-filter-to-drop-specific-events-on-the-heavy/m-p/414408#M73301 <P>No.. it's only required on the instance where events go through parsingQueue (which is HF in your case).</P> Fri, 12 Apr 2019 19:14:05 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-setup-a-filter-to-drop-specific-events-on-the-heavy/m-p/414408#M73301 somesoni2 2019-04-12T19:14:05Z https://community.splunk.com/t5/Getting-Data-In/How-to-setup-a-filter-to-drop-specific-events-on-the-heavy/m-p/414409#M73302 <P>You need to restart all Splunk instances on the nodes that run the first full instance of Splunk handling the data (your HFs). Old events will stay broken but new events will be correct.</P> Sun, 14 Apr 2019 06:35:06 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-setup-a-filter-to-drop-specific-events-on-the-heavy/m-p/414409#M73302 woodcock 2019-04-14T06:35:06Z