How to configure props.conf and/or transforms.conf to filter out events with a specific sourcetype?

[Bill_B]

I am working on what should be a very easy filter, but cannot get it to work. I want to filter out events with sourcetype="WinEventLog:ForwardedEvents". This is my props and transforms in $SPLUNK_HOME/etc/system/local.

props.conf

[WinEventLog:ForwardedEvents]
TRANSFORMS-wmi=wminull


transforms.conf


[wminull]
REGEX= .
DEST_KEY=queue
FORMAT=nullQueue

Any help you can give me is very appreciated.

[sbrant_splunk]

Are you running Splunk on multiple servers? If so, your props and transforms files should reside on the indexer or on the heavy forwarder, if you're using one.

[somesoni2]

I guess these configurations should be in heavy forwarder not on indexer. In case of universal forwarders it should be in indexers.

[Bill_B]

Thanks. I'll check the spaces.
I have 2 indexers and several heavy forwarders. This particular config is on the main indexer which also serves as the search head.
Thanks for the help!

[somesoni2]

Check the spaces between properties and "=" sign. It should be attribute_name (space) = (space) attribute_value. ALso a restart of splunk will be required (if not already doing)