Problem with filtering in props and transforms files

[AdrianV1_2]

Good afternoon.

When filtering events before indexing there is something wrong, because for unknown reasons this filter is not being applied correctly and events are still being sent which should be discarded. The configuration I have in the props and transforms files is the following (this filter has been applied both locally, and in the default and local folders of the corresponding app)

[props]

[traffic] (This would be the sourcetype through which these events pass.)
TRANSFORMS-null= filter_to_null

[transforms]

[filter_to_null]
REGEX = (?:6|7)\.company.com\.es\s\d(?:[^,]*,){25}(?!53|389|3389|445|20|21|22|23|80|8443|8080|443)
DEST_KEY = queue
FORMAT = nullQueue

I have seen different forums but I can't find the problem and in principle the regex does work as it has been tested on different sites and on splunk itself.

[somesoni2]

Are you deploying these filter configurations to your Heavy forwarders/indexers (whichever is the Splunk Enterprise/Cloud instance that comes first in the data flow)? (and restarted Splunk)

[AdrianV1_2]

Yes, I am applying these settings on the HF with your subsequent splunk service restart.