First, you say:
2. create etc\apps\search\local\inputs.conf:
[nullPound]
REGEX = ^#
DEST_KEY = queue
FORMAT = nullQueue
Either this is a typo when you asked the question, or you are putting this line in the wrong config file. (this should be in transforms.conf)
Then, It seems like you are never actually calling the [nullPound] transform, ie, something like this should work:
[proxy]
TRANSFORMS-logformat = proxy, nullPound
and Third, do you need these field extractions to be index time field extraction? Have you thought of using Search time field extractions instead? (it would make your indexing faster..)
http://www.splunk.com/base/Documentation/4.1.5/Knowledge/Createandmaintainsearch-timefieldextractionsthroughconfigurationfiles
More specifically, this should be helpful:
Extract multiple fields using one regex
This is an example of a field extraction that pulls out five separate fields. You can then use these fields in concert with some event types to help you find port flapping events and report on them.
Here's a sample of the event data that the fields are being extracted from:
#%LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet9/16, changed state to down
The stanza in props.conf for the extraction looks like this:
[syslog]
EXTRACT-<port_flapping> = Interface\s(?<interface>(?<media>[^\d]+)(?<slot>\d+)\/(?<port>\d+))\,\schanged
\sstate\sto\s(?<port_status>up|down)
... View more
