https://community.splunk.com/t5/Splunk-Search/Encountered-the-following-error-while-trying-to-update-Invalid/m-p/371408#M109289 <P>I've got this simple transform for dropping unwanted logs which works fine. I went to add something to it and got this <CODE>Encountered the following error while trying to update: Invalid FORMAT: nullQueue</CODE> error when I tried to save it. Then I Canceled, and re-clicked on the transform (in Settings&gt;&gt;Fields&gt;&gt;Field transformations) and tried a Save without changing anything and got the same error. Why is that?</P> <PRE><CODE>[paloaltoNoiseDrop] REGEX = syslog-conn-status,.*(established|broken) DEST_KEY = queue FORMAT = nullQueue </CODE></PRE> Wed, 16 Aug 2017 16:42:41 GMT wrangler2x 2017-08-16T16:42:41Z https://community.splunk.com/t5/Splunk-Search/Encountered-the-following-error-while-trying-to-update-Invalid/m-p/371408#M109289 <P>I've got this simple transform for dropping unwanted logs which works fine. I went to add something to it and got this <CODE>Encountered the following error while trying to update: Invalid FORMAT: nullQueue</CODE> error when I tried to save it. Then I Canceled, and re-clicked on the transform (in Settings&gt;&gt;Fields&gt;&gt;Field transformations) and tried a Save without changing anything and got the same error. Why is that?</P> <PRE><CODE>[paloaltoNoiseDrop] REGEX = syslog-conn-status,.*(established|broken) DEST_KEY = queue FORMAT = nullQueue </CODE></PRE> Wed, 16 Aug 2017 16:42:41 GMT https://community.splunk.com/t5/Splunk-Search/Encountered-the-following-error-while-trying-to-update-Invalid/m-p/371408#M109289 wrangler2x 2017-08-16T16:42:41Z https://community.splunk.com/t5/Splunk-Search/Encountered-the-following-error-while-trying-to-update-Invalid/m-p/371409#M109290 <P>You can implement above use case only through backend i.e., edit transforms.conf by login to the server. In GUI format is only defined like fieldname::$1 or $1.Otherwise you can try like below,</P> <P>[setnull]<BR /> FORMAT = setnull::nullQueue<BR /> REGEX = syslog<BR /> disabled = 1</P> Wed, 16 Aug 2017 17:02:19 GMT https://community.splunk.com/t5/Splunk-Search/Encountered-the-following-error-while-trying-to-update-Invalid/m-p/371409#M109290 sbbadri 2017-08-16T17:02:19Z