Getting Data In

how to send a WMI service to the nullQueue

morphis72
Path Finder

I'm trying to send some service status that I'm collecting from a group of servers to the nullQueue. The servers where I don't want to keep the data all match a naming pattern of "host = XYZ123456"
sourcetype = WMI:Services
source = WMI:Services

My below props and transforms are deployed to my indexers but it's not matching and the events are still being indexed.

props.conf

[WMI:Services]
TRANSFORMS-wminull = nullit

transforms.conf

    [nullit]
    REGEX=(?m)host\s=\s[XYZ]+\d+
    DEST_KEY=queue
    FORMAT=nullQueue
0 Karma
1 Solution

woodcock
Esteemed Legend

If you are sure that your settings are correct, it must be something else. If you are doing a sourcetype override/overwrite, you must use the ORIGINAL value, NOT the new value. You must deploy your settings to the first full instance(s) of Splunk that handle the events (usually either the HF tier if you use one, or else your Indexer tier) UNLESS you are using HEC's JSON endpoint (it gets pre-cooked) or INDEXED_EXTRACTIONS (configs go on the UF in that case), then restart all Splunk instances there. When (re)evaluating, you must send in new events (old events will stay broken), then test using _index_earliest=-5m to be absolutely certain that you are only examining the newly indexed events.

View solution in original post

0 Karma

woodcock
Esteemed Legend

If you are sure that your settings are correct, it must be something else. If you are doing a sourcetype override/overwrite, you must use the ORIGINAL value, NOT the new value. You must deploy your settings to the first full instance(s) of Splunk that handle the events (usually either the HF tier if you use one, or else your Indexer tier) UNLESS you are using HEC's JSON endpoint (it gets pre-cooked) or INDEXED_EXTRACTIONS (configs go on the UF in that case), then restart all Splunk instances there. When (re)evaluating, you must send in new events (old events will stay broken), then test using _index_earliest=-5m to be absolutely certain that you are only examining the newly indexed events.

0 Karma

somesoni2
Revered Legend

What type of Splunk is installed on the machines from where you're collecting WMI service data? Also, if you don't want to ingest any data for that sourcetype, why not just disable the input itself (it must be setup in some inputs.conf to collect that WMI data)?

0 Karma

morphis72
Path Finder

7.2.4 UF on windows servers sending data to a distributed Linux spunk environment. The app I am pushing out is going to a group of servers. Some of which need to collect the WIM counters and some do not. It depends on their role.

0 Karma

somesoni2
Revered Legend

you can blacklist those hosts (since they've a pattern) from receiving the WMI monitoring app. https://docs.splunk.com/Documentation/Splunk/8.0.0/Updating/Filterclients#Define_filters_through_ser...

0 Karma

morphis72
Path Finder

If I black listed them they wouldn't receive the rest of the monitoring that is in the app. I could split this into two apps but I was trying to keep the administration simple with one app to push out.

0 Karma

somesoni2
Revered Legend

It's either managing two apps or adding overhead during indexing (each events for that sourcetype will undergo that TRANSFORM adding overhead processing at indexer/intermediate forwarder).

0 Karma

morphis72
Path Finder

Fair enough. I think I will split into two apps.

0 Karma

mayurr98
Super Champion

try using btool command to debug the issue

./splunk cmd btool transforms list --debug

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...