topic Re: how to send a WMI service to the nullQueue in Getting Data In

how to send a WMI service to the nullQueue

morphis72 — Wed, 06 Nov 2019 18:21:22 GMT

I'm trying to send some service status that I'm collecting from a group of servers to the nullQueue. The servers where I don't want to keep the data all match a naming pattern of "host = XYZ123456"
sourcetype = WMI:Services
source = WMI:Services

My below props and transforms are deployed to my indexers but it's not matching and the events are still being indexed.

props.conf

[WMI:Services]
TRANSFORMS-wminull = nullit

transforms.conf

    [nullit]
    REGEX=(?m)host\s=\s[XYZ]+\d+
    DEST_KEY=queue
    FORMAT=nullQueue

Re: how to send a WMI service to the nullQueue

mayurr98 — Wed, 06 Nov 2019 20:14:19 GMT

try using btool command to debug the issue

./splunk cmd btool transforms list --debug

Re: how to send a WMI service to the nullQueue

somesoni2 — Wed, 06 Nov 2019 20:26:48 GMT

What type of Splunk is installed on the machines from where you're collecting WMI service data? Also, if you don't want to ingest any data for that sourcetype, why not just disable the input itself (it must be setup in some inputs.conf to collect that WMI data)?

Re: how to send a WMI service to the nullQueue

morphis72 — Wed, 06 Nov 2019 21:01:36 GMT

7.2.4 UF on windows servers sending data to a distributed Linux spunk environment. The app I am pushing out is going to a group of servers. Some of which need to collect the WIM counters and some do not. It depends on their role.

Re: how to send a WMI service to the nullQueue

somesoni2 — Wed, 06 Nov 2019 21:32:23 GMT

you can blacklist those hosts (since they've a pattern) from receiving the WMI monitoring app. https://docs.splunk.com/Documentation/Splunk/8.0.0/Updating/Filterclients#Define_filters_through_serverclass.conf

Re: how to send a WMI service to the nullQueue

morphis72 — Wed, 06 Nov 2019 21:41:36 GMT

If I black listed them they wouldn't receive the rest of the monitoring that is in the app. I could split this into two apps but I was trying to keep the administration simple with one app to push out.

Re: how to send a WMI service to the nullQueue

somesoni2 — Wed, 06 Nov 2019 21:58:54 GMT

It's either managing two apps or adding overhead during indexing (each events for that sourcetype will undergo that TRANSFORM adding overhead processing at indexer/intermediate forwarder).

Re: how to send a WMI service to the nullQueue

woodcock — Wed, 30 Sep 2020 02:50:15 GMT

If you are sure that your settings are correct, it must be something else. If you are doing a sourcetype override/overwrite, you must use the ORIGINAL value, NOT the new value. You must deploy your settings to the first full instance(s) of Splunk that handle the events (usually either the HF tier if you use one, or else your Indexer tier) UNLESS you are using HEC's JSON endpoint (it gets pre-cooked) or INDEXED_EXTRACTIONS (configs go on the UF in that case), then restart all Splunk instances there. When (re)evaluating, you must send in new events (old events will stay broken), then test using _index_earliest=-5m to be absolutely certain that you are only examining the newly indexed events.

Re: how to send a WMI service to the nullQueue

morphis72 — Fri, 08 Nov 2019 14:47:29 GMT

Fair enough. I think I will split into two apps.