I am working on what should be a very easy filter, but cannot get it to work. I want to filter out events with sourcetype="WinEventLog:ForwardedEvents". This is my props and transforms in $SPLUNK_HOME/etc/system/local.
props.conf
[WinEventLog:ForwardedEvents]
TRANSFORMS-wmi=wminull
transforms.conf
[wminull]
REGEX= .
DEST_KEY=queue
FORMAT=nullQueue
Any help you can give me is very appreciated.
Are you running Splunk on multiple servers? If so, your props and transforms files should reside on the indexer or on the heavy forwarder, if you're using one.
I guess these configurations should be in heavy forwarder not on indexer. In case of universal forwarders it should be in indexers.
Thanks. I'll check the spaces.
I have 2 indexers and several heavy forwarders. This particular config is on the main indexer which also serves as the search head.
Thanks for the help!
Check the spaces between properties and "=" sign. It should be attribute_name (space) = (space) attribute_value. ALso a restart of splunk will be required (if not already doing)