Getting Data In

Universal Forwarder + nullQueue

ruisantos
Path Finder

I'm trying to remove some of the events that should be forwarded to the frontend.
From a configuration perspective everything is OK.

transforms.conf

[nullMon]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue

[routeRemains]
REGEX = .
DEST_KEY=_TCP_ROUTING
FORMAT= tcp_out

props.conf

[source_log]
TRANSFORMS = nullMon, routeRemains

But I'm receiving everything on the destination host.
Does the Universal Forwarder allow the use of nullQueues?

0 Karma
1 Solution

kristian_kolb
Ultra Champion

No, since nullQueue tranformations take place during the parsing phase, this configuration is only valid on either a Heavy Forwarder or an Indexer.

http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings

/K

View solution in original post

fervin
Path Finder

No, you'd need to configure this transform on an indexer or heavy forwarder. See http://docs.splunk.com/Documentation/Splunk/6.0/Indexer/Howindexingworks

0 Karma

kristian_kolb
Ultra Champion

No, since nullQueue tranformations take place during the parsing phase, this configuration is only valid on either a Heavy Forwarder or an Indexer.

http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings

/K

Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out >> As our brave ...