Why is the discard of specific events not working in props.conf and transforms.conf

[simpkins1958]

I am forwarding data from Splunk Enterprise on one server to Splunk Enterprise on a second server. Data is getting indexed on 2nd server as expected.

On the receiving Splunk Enterprise server I want to ignore events with source of NetMotion. I have configured props.conf and transforms.conf and placed them in C:\Program Files\Splunk\etc\system\local per instructions from http://docs.splunk.com/Documentation/Splunk/6.6.0/Forwarding/Routeandfilterdatad#Discard_specific_ev...
Can't get this working. All the data from source=NetMotion is still getting indexed on the 2nd server.

I have restarted the Splunk server.

props.conf:
[source::NetMotion]
TRANSFORMS-null= setnull

transforms.conf:
[setnull]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue

[somesoni2 · Accepted solution]

The data parsing, including routing, happens on the first Splunk Enterprise instance that appears in the flow. Based on description above, it seems that your first Splunk Enterprise instance is acting as heavy forwarder and these props/transforms entries should be kept in heavy forwarder when it's used. (setup these in first Splunk Enterprise instance and restart Splunk service on it).