Getting Data In

Why is my nullQueue configuration in inputs.conf and transforms.conf not working?

BBakkenes
Explorer

Hello Splunkers!

I am having difficulties with my nullQueue configuration when trying to exclude rows with JS, CSS, and images.
Trying the regex in the Splunk search works fine, but the events are still indexed by Splunk.
My setup is a single Splunk instance and the conf files are in /etc/system/local.

Inputs.conf

[monitor://C:\Users\admin\Desktop\test.log]
disabled = false
host = bla
sourcetype = Transform_Test
TRANSFORMS-null= setnull

Transforms.conf

[setnull]
REGEX = (?m)^.*(gif|css|js|jpg|png|ico)\s.*$
DEST_KEY = queue
FORMAT = nullQueue

What to exclude:

192.168.1.3 - - [09/Sep/2015:09:35:46 +0200] "GET /work/js/abc.js HTTP/1.1" 200 41162 392
192.168.1.3 - - [09/Sep/2015:09:35:46 +0200] "GET /work/images/test.gif HTTP/1.0" 200 135 20

What to include:

192.168.1.3 - - [09/Sep/2015:09:35:44 +0200] "POST /bla/abc.jsp?target=layout!ba!searchForm&eventName=Search HTTP/1.1" 200 184359 1832621

When changing the regex to \[sshd\] and make an event [sshd] in the logfile, the event isn't excluded as well. So it doesn't look like an problem with the regex.

Does someone have any idea?

0 Karma
1 Solution

tskinnerivsec
Contributor

You don't use inputs.conf files to call transforms. You need to have a props.conf file. So, in your props.conf file you would have something to the affect of:

[Transform_Test]
TRANSFORMS-null= setnull

then you can leave your transforms.conf file the way it is.

View solution in original post

tskinnerivsec
Contributor

You don't use inputs.conf files to call transforms. You need to have a props.conf file. So, in your props.conf file you would have something to the affect of:

[Transform_Test]
TRANSFORMS-null= setnull

then you can leave your transforms.conf file the way it is.

Get Updates on the Splunk Community!

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...