Transforms.conf issue

[nmccaffery333]

We're working with a 30 day trial as we wait for procurement to purchase a full license. While learning and configuring the system, I'm working on getting rid of some events we don't want to see. So far it's not working.

My first question is, will this work on a Trial license?

If it will, here's what my files looks like. I've tried as many combinations and formats as I can find examples for. I had the Transforms settings all in one stanza to start with, below is my latest attempt.
If I run "splunk btool check", I see no errors.
Help! Please .

props.conf:

[WinEventLog:Security]
TRANSFORMS-security = setnull0

[WMI:WinEventLog:System]
TRANSFORMS-wmisystem = setnull1

[WinEventLog:System]
TRANSFORMS-system = setnull2

transforms.conf:

[setnull0]
SOURCE_KEY = dest
REGEX = ^EventCode=(1107|4688|7036|10028)\D
DEST_KEY = queue
FORMAT = nullQueue

[setnull1]
SOURCE_KEY = dest
REGEX = ^EventCode=(1107|4688|7036|10028)\D
DEST_KEY = queue
FORMAT = nullQueue

[setnull2]
SOURCE_KEY = dest
REGEX = ^EventCode=(1107|4688|7036|10028)\D
DEST_KEY = queue
FORMAT = nullQueue

[nmccaffery333]

Here's and example event;

09/17/2020 12:10:53 PM
LogName=System
SourceName=Microsoft-Windows-Service Control Manager
EventCode=7036
EventType=4
Type=Information
ComputerName=oneof.my.servers
TaskCategory=None
OpCode=The operation completed successfully.
RecordNumber=15183030

[nmccaffery333]

That makes sense, and I think I tried it before. I just tried it again and those events are still showing up.

[richgalloway]

Yes, it will work with a trial license.

Try removing the ^ from the REGEX settings.  The existing settings will fail since the events do not begin with "EventCode".