Getting Data In

how to send a WMI service to the nullQueue

New Member

I'm trying to send some service status that I'm collecting from a group of servers to the nullQueue. The servers where I don't want to keep the data all match a naming pattern of "host = XYZ123456"
sourcetype = WMI:Services
source = WMI:Services

My below props and transforms are deployed to my indexers but it's not matching and the events are still being indexed.

props.conf

[WMI:Services]
TRANSFORMS-wminull = nullit

transforms.conf

    [nullit]
    REGEX=(?m)host\s=\s[XYZ]+\d+
    DEST_KEY=queue
    FORMAT=nullQueue
0 Karma
1 Solution

Esteemed Legend

If you are sure that your settings are correct, it must be something else. If you are doing a sourcetype override/overwrite, you must use the ORIGINAL value, NOT the new value. You must deploy your settings to the first full instance(s) of Splunk that handle the events (usually either the HF tier if you use one, or else your Indexer tier) UNLESS you are using HEC's JSON endpoint (it gets pre-cooked) or INDEXED_EXTRACTIONS (configs go on the UF in that case), then restart all Splunk instances there. When (re)evaluating, you must send in new events (old events will stay broken), then test using _index_earliest=-5m to be absolutely certain that you are only examining the newly indexed events.

View solution in original post

0 Karma

Esteemed Legend

If you are sure that your settings are correct, it must be something else. If you are doing a sourcetype override/overwrite, you must use the ORIGINAL value, NOT the new value. You must deploy your settings to the first full instance(s) of Splunk that handle the events (usually either the HF tier if you use one, or else your Indexer tier) UNLESS you are using HEC's JSON endpoint (it gets pre-cooked) or INDEXED_EXTRACTIONS (configs go on the UF in that case), then restart all Splunk instances there. When (re)evaluating, you must send in new events (old events will stay broken), then test using _index_earliest=-5m to be absolutely certain that you are only examining the newly indexed events.

View solution in original post

0 Karma

Revered Legend

What type of Splunk is installed on the machines from where you're collecting WMI service data? Also, if you don't want to ingest any data for that sourcetype, why not just disable the input itself (it must be setup in some inputs.conf to collect that WMI data)?

0 Karma

New Member

7.2.4 UF on windows servers sending data to a distributed Linux spunk environment. The app I am pushing out is going to a group of servers. Some of which need to collect the WIM counters and some do not. It depends on their role.

0 Karma

Revered Legend

you can blacklist those hosts (since they've a pattern) from receiving the WMI monitoring app. https://docs.splunk.com/Documentation/Splunk/8.0.0/Updating/Filterclients#Define_filters_through_ser...

0 Karma

New Member

If I black listed them they wouldn't receive the rest of the monitoring that is in the app. I could split this into two apps but I was trying to keep the administration simple with one app to push out.

0 Karma

Revered Legend

It's either managing two apps or adding overhead during indexing (each events for that sourcetype will undergo that TRANSFORM adding overhead processing at indexer/intermediate forwarder).

0 Karma

New Member

Fair enough. I think I will split into two apps.

0 Karma

SplunkTrust
SplunkTrust

try using btool command to debug the issue

./splunk cmd btool transforms list --debug

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!