https://community.splunk.com/t5/Getting-Data-In/Can-you-help-me-with-my-data-filtering-query/m-p/450100#M78157 <P>@satyaallaparthi Can you confirm that the data in question is first reaching HF and then being forwarded to indexer(s)? Also, if you want all the data with sourcetype=WinEventLog:Microsoft-Windows-Sysmon/Operational to be sent to null queue, why don't you have REGEX set to . ? And same for smps. Try removing SOURCE_KEY in transforms and restart splunk.</P> Tue, 30 Oct 2018 19:41:19 GMT Rob2520 2018-10-30T19:41:19Z https://community.splunk.com/t5/Getting-Data-In/Can-you-help-me-with-my-data-filtering-query/m-p/450099#M78156 <P>I am trying to filter the data sourcetype= WinEventLog:Microsoft-Windows-Sysmon/Operational , sourcetype=WinEventLog:Microsoft-Windows-Sysmon/Operational and the source = E:\Eam\Siteminder\Log\smps.log. These are being sent by some one else to my Splunk instance and I don't want to receive any of the above data from any server. I wrote transforms.conf and props.conf in the heavy forwarder, but still, I am getting that data from all those...</P> <P>*<EM>props.conf *</EM></P> <P>[WinEventLog:Microsoft-Windows-Sysmon/Operational]<BR /> TRANSFORMS-call = noncommon</P> <P>[WinEventLog:Microsoft-Windows-System]<BR /> TRANSFORMS-call = common</P> <P>[source::*smps.log]<BR /> TRANSFORMS-call = filter</P> <P><STRONG>transforms.conf :</STRONG></P> <P>[noncommon]<BR /> SOURCE_KEY = MetaData:Sourcetype<BR /> REGEX = Sysmon<BR /> DEST_KEY = queue<BR /> FORMAT = nullQueue</P> <P>[common]<BR /> REGEX = .<BR /> DEST_KEY = queue<BR /> FORMAT = nullQueue</P> <P>[filter]<BR /> SOURCE_KEY = MetaData:Source<BR /> REGEX = smps<BR /> DEST_KEY = queue<BR /> FORMAT = nullQueue</P> <P>[accepted_keys] <BR /> is_valid=_SYSLOG_ROUTING</P> Tue, 29 Sep 2020 21:46:47 GMT https://community.splunk.com/t5/Getting-Data-In/Can-you-help-me-with-my-data-filtering-query/m-p/450099#M78156 satyaallaparthi 2020-09-29T21:46:47Z https://community.splunk.com/t5/Getting-Data-In/Can-you-help-me-with-my-data-filtering-query/m-p/450100#M78157 <P>@satyaallaparthi Can you confirm that the data in question is first reaching HF and then being forwarded to indexer(s)? Also, if you want all the data with sourcetype=WinEventLog:Microsoft-Windows-Sysmon/Operational to be sent to null queue, why don't you have REGEX set to . ? And same for smps. Try removing SOURCE_KEY in transforms and restart splunk.</P> Tue, 30 Oct 2018 19:41:19 GMT https://community.splunk.com/t5/Getting-Data-In/Can-you-help-me-with-my-data-filtering-query/m-p/450100#M78157 Rob2520 2018-10-30T19:41:19Z https://community.splunk.com/t5/Getting-Data-In/Can-you-help-me-with-my-data-filtering-query/m-p/450101#M78158 <P>Yes I did tried REGEX= . and removed the source_key aswell and restarted..and I dont wanna receive any data from those sourcetypes and source E://EAM* but still am getting data from those. Please help me with that. </P> <P>thanks, </P> Tue, 30 Oct 2018 19:54:31 GMT https://community.splunk.com/t5/Getting-Data-In/Can-you-help-me-with-my-data-filtering-query/m-p/450101#M78158 satyaallaparthi 2018-10-30T19:54:31Z https://community.splunk.com/t5/Getting-Data-In/Can-you-help-me-with-my-data-filtering-query/m-p/450102#M78159 <P>For filtering events like you want you simply have to create one rule, but you have to define <CODE>source::</CODE> </P> <P>props.conf</P> <PRE><CODE>[source::WinEventLog:Microsoft-Windows-Sysmon/Operational] TRANSFORMS-call = drop [source::WinEventLog:Microsoft-Windows-System] TRANSFORMS-call = drop [source::E:\Eam\Siteminder\Log\smps.log] TRANSFORMS-call = drop </CODE></PRE> <P>transforms.conf</P> <PRE><CODE>[drop] REGEX = . DEST_KEY = queue FORMAT = nullQueue </CODE></PRE> <P>Put those files on the indexers and restart it. </P> Fri, 22 Feb 2019 13:34:37 GMT https://community.splunk.com/t5/Getting-Data-In/Can-you-help-me-with-my-data-filtering-query/m-p/450102#M78159 markusspitzli 2019-02-22T13:34:37Z