Getting Data In

Why is my nullQueue configuration in inputs.conf and transforms.conf not working?

BBakkenes
Explorer

Hello Splunkers!

I am having difficulties with my nullQueue configuration when trying to exclude rows with JS, CSS, and images.
Trying the regex in the Splunk search works fine, but the events are still indexed by Splunk.
My setup is a single Splunk instance and the conf files are in /etc/system/local.

Inputs.conf

[monitor://C:\Users\admin\Desktop\test.log]
disabled = false
host = bla
sourcetype = Transform_Test
TRANSFORMS-null= setnull

Transforms.conf

[setnull]
REGEX = (?m)^.*(gif|css|js|jpg|png|ico)\s.*$
DEST_KEY = queue
FORMAT = nullQueue

What to exclude:

192.168.1.3 - - [09/Sep/2015:09:35:46 +0200] "GET /work/js/abc.js HTTP/1.1" 200 41162 392
192.168.1.3 - - [09/Sep/2015:09:35:46 +0200] "GET /work/images/test.gif HTTP/1.0" 200 135 20

What to include:

192.168.1.3 - - [09/Sep/2015:09:35:44 +0200] "POST /bla/abc.jsp?target=layout!ba!searchForm&eventName=Search HTTP/1.1" 200 184359 1832621

When changing the regex to \[sshd\] and make an event [sshd] in the logfile, the event isn't excluded as well. So it doesn't look like an problem with the regex.

Does someone have any idea?

0 Karma
1 Solution

tskinnerivsec
Contributor

You don't use inputs.conf files to call transforms. You need to have a props.conf file. So, in your props.conf file you would have something to the affect of:

[Transform_Test]
TRANSFORMS-null= setnull

then you can leave your transforms.conf file the way it is.

View solution in original post

tskinnerivsec
Contributor

You don't use inputs.conf files to call transforms. You need to have a props.conf file. So, in your props.conf file you would have something to the affect of:

[Transform_Test]
TRANSFORMS-null= setnull

then you can leave your transforms.conf file the way it is.

Get Updates on the Splunk Community!

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...

Avoid Certificate Expiry Issues in Splunk Enterprise with Certificate Assist

This blog post is part 2 of 4 of a series on Splunk Assist. Click the links below to see the other ...

Using Machine Learning for Hunting Security Threats

REGISTER NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more ...