Why is my nullQueue configuration in inputs.conf and transforms.conf not working?

[BBakkenes]

Hello Splunkers!

I am having difficulties with my nullQueue configuration when trying to exclude rows with JS, CSS, and images.
Trying the regex in the Splunk search works fine, but the events are still indexed by Splunk.
My setup is a single Splunk instance and the conf files are in /etc/system/local.

Inputs.conf

[monitor://C:\Users\admin\Desktop\test.log]
disabled = false
host = bla
sourcetype = Transform_Test
TRANSFORMS-null= setnull

Transforms.conf

[setnull]
REGEX = (?m)^.*(gif|css|js|jpg|png|ico)\s.*$
DEST_KEY = queue
FORMAT = nullQueue

What to exclude:

192.168.1.3 - - [09/Sep/2015:09:35:46 +0200] "GET /work/js/abc.js HTTP/1.1" 200 41162 392
192.168.1.3 - - [09/Sep/2015:09:35:46 +0200] "GET /work/images/test.gif HTTP/1.0" 200 135 20

What to include:

192.168.1.3 - - [09/Sep/2015:09:35:44 +0200] "POST /bla/abc.jsp?target=layout!ba!searchForm&eventName=Search HTTP/1.1" 200 184359 1832621

When changing the regex to \[sshd\] and make an event [sshd] in the logfile, the event isn't excluded as well. So it doesn't look like an problem with the regex.

Does someone have any idea?

[tskinnerivsec · Accepted solution]

You don't use inputs.conf files to call transforms. You need to have a props.conf file. So, in your props.conf file you would have something to the affect of:

[Transform_Test]
TRANSFORMS-null= setnull

then you can leave your transforms.conf file the way it is.