Getting Data In

How can I find out what events get sent to the nullQueue when I try to filter events on a forwarder?

chris
Motivator

Hi

I am trying to filter events on a LightWeightForwarder, but they don't get dropped. Is there a way to debug this?

I have defined the following in an app which I deploy from the indexer.

In props.conf
[source::/var/opt/app/logs/navajo.log]
TRANSFORMS-set= setnull

In transforms.conf
[setnull]
REGEX=toolbar
DEST_KEY=queue
FORMAT=nullQueue

The events containing "toolbar" keep coming. Even if I set the regex to "REGEX=." the events still arrive on the indexer.

Any ideas?

Tags (1)
1 Solution

BunnyHop
Contributor

LWF does not perform the indexing, and therefore, does not do anything with the event but forward it. You should place this on the receiver. Your syntax is correct, just need to move the config to the receiver. Make sure you restart.

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

LWF can't filter because it doesn't look at the the incoming data. Please read here for explanation: http://www.splunk.com/wiki/Where_do_I_configure_my_Splunk_settings%3F

chris
Motivator

Thank you. That link clarifies a lot

0 Karma

BunnyHop
Contributor

LWF does not perform the indexing, and therefore, does not do anything with the event but forward it. You should place this on the receiver. Your syntax is correct, just need to move the config to the receiver. Make sure you restart.

chris
Motivator

That was it, thanks a lot

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...