nullQueue for Windows event codes not working

[ebailey]

Hello,

I am trying to setup a nullQueue for Windows security events we do not care to index into Splunk and my configuration is not working. I am using the below on the Indexer and restarted Splunk. I do not see any errors and I am not sure how else to troubleshoot the issue. The sourcetype in the props matches the sourcetype of the data. Any feedback is most appreciated.

props.conf

[WinEventLog:Security]
TRANSFORMS-WinEvents=eliminate-eventcodes

transforms.conf

[eliminate-eventcodes]
REGEX = EventCode=(5156|4656|33205|5158|577|578|5157|5145|4769|4768|5145|4634)
DEST_KEY = queue
FORMAT = nullQueue

[masonmorales]

Try...

props.conf

[WinEventLog:Security]
TRANSFORMS-DiscardWinEvents = eliminate-eventcodes

transforms.conf

[eliminate-eventcodes]
REGEX = (?m)^EventCode=(5156|4656|33205|5158|577|578|5157|5145|4769|4768|5145|4634)
DEST_KEY = queue
FORMAT = nullQueue

You'll need to restart your indexer again after making the change.

[ebailey]

No joy - I made the change and then restarted splunkd. The events are still being indexed. I have other data getting dumped to nullqeueu so this not working is confusing.

[yannK]

if you are using an Universal/Lightweight forwarder, then the nullQueue props/transforms have to be on the indexers.
But if you re using heavy forwarders (HF), you need to put the props/transforms have to to be on the HF.

otherwise since splunk 5, you can filter evencodes directly on the forwarders in the inputs.con (look for blacklist under WinEventcode)

[ebailey]

the settings are on the indexers - I am working with support on the issue - Thanks for the suggestions

[masonmorales]

Could email me a ./splunk diag from your forwarder and your indexer? (See e-mail address in my portfolio)