how to send a WMI service to the nullQueue

[morphis72]

I'm trying to send some service status that I'm collecting from a group of servers to the nullQueue. The servers where I don't want to keep the data all match a naming pattern of "host = XYZ123456"
sourcetype = WMI:Services
source = WMI:Services

My below props and transforms are deployed to my indexers but it's not matching and the events are still being indexed.

props.conf

[WMI:Services]
TRANSFORMS-wminull = nullit

transforms.conf

    [nullit]
    REGEX=(?m)host\s=\s[XYZ]+\d+
    DEST_KEY=queue
    FORMAT=nullQueue

[woodcock · Accepted solution]

If you are sure that your settings are correct, it must be something else. If you are doing a sourcetype override/overwrite, you must use the ORIGINAL value, NOT the new value. You must deploy your settings to the first full instance(s) of Splunk that handle the events (usually either the HF tier if you use one, or else your Indexer tier) UNLESS you are using HEC's JSON endpoint (it gets pre-cooked) or INDEXED_EXTRACTIONS (configs go on the UF in that case), then restart all Splunk instances there. When (re)evaluating, you must send in new events (old events will stay broken), then test using _index_earliest=-5m to be absolutely certain that you are only examining the newly indexed events.

[somesoni2]

What type of Splunk is installed on the machines from where you're collecting WMI service data? Also, if you don't want to ingest any data for that sourcetype, why not just disable the input itself (it must be setup in some inputs.conf to collect that WMI data)?

[morphis72]

7.2.4 UF on windows servers sending data to a distributed Linux spunk environment. The app I am pushing out is going to a group of servers. Some of which need to collect the WIM counters and some do not. It depends on their role.

[somesoni2]

you can blacklist those hosts (since they've a pattern) from receiving the WMI monitoring app. https://docs.splunk.com/Documentation/Splunk/8.0.0/Updating/Filterclients#Define_filters_through_ser...

[morphis72]

If I black listed them they wouldn't receive the rest of the monitoring that is in the app. I could split this into two apps but I was trying to keep the administration simple with one app to push out.

[somesoni2]

It's either managing two apps or adding overhead during indexing (each events for that sourcetype will undergo that TRANSFORM adding overhead processing at indexer/intermediate forwarder).

[morphis72]

Fair enough. I think I will split into two apps.

[mayurr98]

try using btool command to debug the issue

./splunk cmd btool transforms list --debug