Why is Nullqueue not working?

[johnansett]

This should be pretty easy but not sure why events are still coming in.

We have hosts set up to send to multiple Splunk stacks and one is security only so we want to drop incoming perfmon data.  I've created the following:

Transforms:

[setnull]
REGEX = (.)
DEST_KEY = queue
FORMAT = nullQueue

Props:

[Perfmon:ProcessorInformation]
TRANSFORMS-proc=setnull

[PerfmonMetrics:CPU]
TRANSFORMS-cpu=setnull

[PerfmonMetrics:LogicalDisk]
TRANSFORMS-ldisk=setnull

[PerfmonMetrics:Memory]
TRANSFORMS-mem=setnull

[PerfmonMetrics:Network]
TRANSFORMS-net=setnull

[PerfmonMetrics:PhysicalDisk]
TRANSFORMS-pdisk=setnull

[PerfmonMetrics:Process]
TRANSFORMS-process=setnull

[PerfmonMetrics:System]
TRANSFORMS-sys=setnull

However these source types are still coming through! It's been pushed out to a cluster from the CM and can see it applied on the indexers.

Any obvious mistakes?

Thanks!

[gcusello]

Hi @johnansett,

if you want to delete all the perfmon logs (or a part of them) before indexing, why don't you disable them in inpus.conf (as I usually do)?

Anyway, where do you located the above props.conf and transforms.conf? they must be located in you Indexers or (if present) in your Heavy Forwarders, not in Universal Forwarders.

Ciao.

Giuseppe

[johnansett]

Hey @gcusello,

I would disable at inputs but unfortunately this is being cloned to multiple Splunk stacks and only one needs the perfmon, AFAIK UF can't route based on sourcetype so it's just being sent to both stacks and we want to drop as it comes into index queue.

props/transforms are pushed to all indexers via cluster master.

[gcusello]

Hi @johnansett,

Let me understand: perfmon are sent and indexed in all your clusters or to a part of them?

if they are sent to all your clusters and muste be veisble by people in each cluster, you cannot delete them before indexing.

If instead you have to send perfmon to a subset of clusters, you should follow the instructions at https://docs.splunk.com/Documentation/Splunk/8.2.6/Forwarding/Routeandfilterdatad#Route_inputs_to_sp... to forwardr some logs only to a selected indexer (or cluster).

Ciao.

Giuseppe

[PickleRick]

Does your source provide a general Perfmon source type and the app rewrites the sourcetype to specific "subtypes"? If so, splunk won't match your props stanza with the rewritten subtypes.

[johnansett]

Hey @PickleRick ,

Yeah, this was my thought too - not sure as I don't have access to the UF/DS but will investigate this... I *think* that the MS TA is rewriting the sourcetypes. I wIll investigate further.

Thanks