I need to filter out certain unwanted events and send them to the nullQueue.
I added this in props.conf:
TRANSFORMS-proj = Filter_ping
and this in transforms.conf
REGEX = Request\:ping
DEST_KEY = queue
FORMAT = nullQueue
This is working perfectly in one env (splunk client+server) but not working in another env. Since the conf files are the same as are the versions of the splunk forwarder and servers. I'm at a lost as to why this filtering fails on the 2nd env.
Any suggestion as to how to debug this? splunkd.log looks normal. I verified that sourcetype access_logs is correct. Anywhere I can look to see what filtering the forwarder has loaded?
Not knowing the environment details, I could only guess at the issue (given that it works in another environment).
If you're using a light weight forwarder, this configuration needs to live on the indexer. If you're using a regular forwarder, this configuration needs to live on the forwarder. You can look at event counts in metrics logs for group=pipeline to see if regex extraction is being run on the machine with the configuration.
On the machine with the configuration, you can check what Splunk is interpreting from the configuration files using: