Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Why is nullQueue configuration not working?
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
/opt/splunk/etc/system/local/transforms.conf
[WhirlpoolMWGBad]
REGEX=200
DEST_KEY=queue
FORMAT=nullQueue
/opt/splunk/etc/system/local/props.conf
[WhirlpoolMWGLog]
NO_BINARY_CHECK = 1
SHOULD_LINEMERGE = false
pulldown_type = 1
TRANSFORMS-WhirlpoolMGWBad = WhirlpoolMGWBad
splunkd is restarted.
lines containing '200' should not get indexed, but they are still getting indexed. What am I missing?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You have a transform name mismatch between your props.conf and transforms.conf. In props.conf you call the transform "WhirlpoolMGWBad" whereas you call the transform "WhirlpoolMWGBad" (you've switched the W and G) in transforms.conf.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You have a transform name mismatch between your props.conf and transforms.conf. In props.conf you call the transform "WhirlpoolMGWBad" whereas you call the transform "WhirlpoolMWGBad" (you've switched the W and G) in transforms.conf.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
d'oh! must have looked at that 5 times. Thank you for that.
is there a way to change the logging levels so that Splunk will log if a non-existent stanza is referenced?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Have you made sure the props and transforms are on all of your indexers? For Nullqueue work it needs to be on the indexers receiving the events.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Does your sourcetype match exactly?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Can you post your sample log event?
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Announcing Modern Navigation: A New Era of Splunk User Experience
Modernize your Splunk Apps – Introducing Python 3.13 in Splunk
Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...
