Getting Data In

Specific DNS queries from Splunk Stream to nullQueue

b_chris21
Communicator

Hello everyone, 

I have tons of DNS queries in my enterprise on commercial legit domains (eg. partnerweb.vmware.com, login.live.com) which I don't want to log with Splunk Stream. My configuration is as follows but apparently it doesn't work:

app: Splunk_TA_stream_wire_data

props.conf

[streamfwd://streamfwd]
TRANSFORMS-blacklist-vmwarecom = vmware.com

transforms.conf

[vmware.com]
REGEX=query\=partnerweb\.vmware\.com
DEST_KEY=queue
FORMAT=nullQueue


Any help would be appreciated.

Kind regards,

Chris

 

Labels (3)
0 Karma
Get Updates on the Splunk Community!

Splunk App for Anomaly Detection End of Life Announcment

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...