Getting Data In

Why is my nullQueue configuration in inputs.conf and transforms.conf not working?

BBakkenes
Explorer

Hello Splunkers!

I am having difficulties with my nullQueue configuration when trying to exclude rows with JS, CSS, and images.
Trying the regex in the Splunk search works fine, but the events are still indexed by Splunk.
My setup is a single Splunk instance and the conf files are in /etc/system/local.

Inputs.conf

[monitor://C:\Users\admin\Desktop\test.log]
disabled = false
host = bla
sourcetype = Transform_Test
TRANSFORMS-null= setnull

Transforms.conf

[setnull]
REGEX = (?m)^.*(gif|css|js|jpg|png|ico)\s.*$
DEST_KEY = queue
FORMAT = nullQueue

What to exclude:

192.168.1.3 - - [09/Sep/2015:09:35:46 +0200] "GET /work/js/abc.js HTTP/1.1" 200 41162 392
192.168.1.3 - - [09/Sep/2015:09:35:46 +0200] "GET /work/images/test.gif HTTP/1.0" 200 135 20

What to include:

192.168.1.3 - - [09/Sep/2015:09:35:44 +0200] "POST /bla/abc.jsp?target=layout!ba!searchForm&eventName=Search HTTP/1.1" 200 184359 1832621

When changing the regex to \[sshd\] and make an event [sshd] in the logfile, the event isn't excluded as well. So it doesn't look like an problem with the regex.

Does someone have any idea?

0 Karma
1 Solution

tskinnerivsec
Contributor

You don't use inputs.conf files to call transforms. You need to have a props.conf file. So, in your props.conf file you would have something to the affect of:

[Transform_Test]
TRANSFORMS-null= setnull

then you can leave your transforms.conf file the way it is.

View solution in original post

tskinnerivsec
Contributor

You don't use inputs.conf files to call transforms. You need to have a props.conf file. So, in your props.conf file you would have something to the affect of:

[Transform_Test]
TRANSFORMS-null= setnull

then you can leave your transforms.conf file the way it is.

Get Updates on the Splunk Community!

Cultivate Your Career Growth with Fresh Splunk Training

Growth doesn’t just happen—it’s nurtured. Like tending a garden, developing your Splunk skills takes the right ...

Introducing a Smarter Way to Discover Apps on Splunkbase

We’re excited to announce the launch of a foundational enhancement to Splunkbase: App Tiering.  Because we’ve ...

How to Send Splunk Observability Alerts to Webex teams in Minutes

As a Developer Evangelist at Splunk, my team and I are constantly tinkering with technology to explore its ...