Getting Data In

Heavy forwarder do not transform


Hi there,

I have a problem with our windows heavy forwarder.
The problem is that the forwarder should transform wmi events from a spezific host.

My props.conf and transform.conf looks like this:




REGEX = (?mi)Type=Audit
DEST_KEY = queue
FORMAT = nullQueue

Do I have a problem with the config or couldn't the heavy forwarder transform the wmi event?


Tags (1)
0 Karma


First, your props.conf is not for a specific host, but for all hosts. Or I should say "all hosts that have data collected by this forwarder."
Second, only events that have "type=audit" in the text will be eliminated.
What hosts and events appear in your Splunk indexer? What do you get if you put type=audit in the search box?

0 Karma


Hi lguinn,

thanks for you reply.

That's right. I only want to eliminated all audit events from these forwarder. Should i use any wildcard in the regex to find all audit success or audit failure events?

At the first time i only want to eliminate all audit events from host server1. I had written the props.conf like this [host::server1] but nothing happens. So i use the wildcard to find all hosts. But this also dosen't work.

0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...