Getting Data In

Why is my nullQueue configuration in inputs.conf and transforms.conf not working?

BBakkenes
Explorer

Hello Splunkers!

I am having difficulties with my nullQueue configuration when trying to exclude rows with JS, CSS, and images.
Trying the regex in the Splunk search works fine, but the events are still indexed by Splunk.
My setup is a single Splunk instance and the conf files are in /etc/system/local.

Inputs.conf

[monitor://C:\Users\admin\Desktop\test.log]
disabled = false
host = bla
sourcetype = Transform_Test
TRANSFORMS-null= setnull

Transforms.conf

[setnull]
REGEX = (?m)^.*(gif|css|js|jpg|png|ico)\s.*$
DEST_KEY = queue
FORMAT = nullQueue

What to exclude:

192.168.1.3 - - [09/Sep/2015:09:35:46 +0200] "GET /work/js/abc.js HTTP/1.1" 200 41162 392
192.168.1.3 - - [09/Sep/2015:09:35:46 +0200] "GET /work/images/test.gif HTTP/1.0" 200 135 20

What to include:

192.168.1.3 - - [09/Sep/2015:09:35:44 +0200] "POST /bla/abc.jsp?target=layout!ba!searchForm&eventName=Search HTTP/1.1" 200 184359 1832621

When changing the regex to \[sshd\] and make an event [sshd] in the logfile, the event isn't excluded as well. So it doesn't look like an problem with the regex.

Does someone have any idea?

0 Karma
1 Solution

tskinnerivsec
Contributor

You don't use inputs.conf files to call transforms. You need to have a props.conf file. So, in your props.conf file you would have something to the affect of:

[Transform_Test]
TRANSFORMS-null= setnull

then you can leave your transforms.conf file the way it is.

View solution in original post

tskinnerivsec
Contributor

You don't use inputs.conf files to call transforms. You need to have a props.conf file. So, in your props.conf file you would have something to the affect of:

[Transform_Test]
TRANSFORMS-null= setnull

then you can leave your transforms.conf file the way it is.

Get Updates on the Splunk Community!

Platform Highlights | November 2022 Newsletter

 November 2022 Skill Up on Splunk with our New Builder Tech Talk SeriesCan you build it? Yes you can! *play ...

Splunk Education - Fast Start Program!

Welcome to Splunk Education! Splunk training programs are designed to enable you to get started quickly and ...

Five Subtly Different Ways of Adding Manual Instrumentation in Java

You can find the code of this example on GitHub here. Please feel free to star the repository to keep in ...