Getting Data In

Why am I not able to exclude events from getting indexed with my current props and transforms.conf?

Explorer

Not able to exclude events from indexing on Splunk Enterprise Free version. Can anyone help me out here?

Sample data:

Name:mango
Name:Mango
Name:ManGo
Name:apple
Name:banana
Name:strawberry
Name:pineapple

props.conf

[txt1]
DATETIME_CONFIG = CURRENT
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
category = Custom
pulldown_type = true
TRANSFORMS-set= setnull

transforms.conf

[setnull]
REGEX = mango
DEST_KEY = queue
FORMAT = nullQueue
0 Karma

SplunkTrust
SplunkTrust

Your regex is case sensitive and therefore Mango != mango != manGo

Try this instead:

REGEX = (?i)mango
0 Karma

Explorer

Want to exclude events which has mango in the event.

0 Karma