Getting Data In

Newbie Question on nullQueue

millerjc123
New Member

Hello Everyone,

I know there are questions similar to mine, but I cannot seem to transform them into a solution for my problem. I am trying to dump information event logs to the nullQueue so they do not count against the cap (company still deciding if they want Splunk). What I currently have is (sorry if new lines are messed up):

transforms.conf:

[RemoveInformation]

REGEX=(?m)Type\s*=\s*Information

DEST_KEY = queue

FORMAT = nullQueue

props.conf:

[WMI:WinEventLog:Application]

TRANSFORMS-wmi= RemoveInformation

[WMI:WinEventLog:Security]

TRANSFORMS-wmi= RemoveInformation

[WMI:WinEventLog:System]

TRANSFORMS-wmi= RemoveInformation

[WMI:WinEventLog:Setup]

TRANSFORMS-wmi= RemoveInformation

I don't believe it matters, but I am using windows based universal forwarder back to a debian based splunk server.

Thank you for any and all suggestions.

Tags (2)
0 Karma

starcher
Influencer

There there is why it is not applying the regex. You have to match the sourcetype.
[WMI:WinEventLog:Security]
TRANSFORMS-wmi= RemoveInformation

Needs to be
[WinEventLog:Security]
TRANSFORMS-WinSecRemove= RemoveInformation

0 Karma

starcher
Influencer

A couple of questions. Are you collecting the logs via wmi? If not then the soucetypes will technically be different and not apply your null queue transform. Next question. Are you using dedicated indexers? If so anything with TRANSFORMS is an index time action and that config must be on each of your indexers not your search head to work.

0 Karma

millerjc123
New Member

We originally turned them off since it set off the daily limit. We now have (in C:\Program Files\SplunkUniversalForwarder\etc\system\local\inputs.conf):

[WinEventLog:Application]
disabled = 0
[WinEventLog:Security]
disabled = 0
[WinEventLog:System]
disabled = 0
[WinEventLog:Setup]
disabled = 0

Enable Service Logs

[WinEventLog:]
disabled = 0
start_from = oldest
current_only = 0
[WinEventLog: Services]
disabled = 0
start_from = oldest
current_only = 0

0 Karma

starcher
Influencer

How are you telling the splunk forwarder to pickup the windows logs? Are you using the Windows TA? Or did you create your own inputs.conf?

0 Karma

millerjc123
New Member

Thank you for taking an interest.

We are using universal forwarders on the windows boxes to send the information back to a Linux ran Splunk instance. I believe that means we are not going wmi (since the splunk server isn't pulling the logs itself). Do you know what I should use in its place? I was also under the impression that universal forwarders cannot do this filter themselves, but my boss was potentially told something else?

Single server Splunk at this time (ignoring the universal forwarders).

0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...