Thank you for your response. Actually, the document you reference is what I've been using to the letter.
The following was added to props.conf for filtering:
[splunkd]
TRANSFORMS-null = setnull
And to transforms.conf:
[setnull]
REGEX = \"INFO\"
DEST_KEY = queue
FORMAT = nullQueue
According to the doc, this should work but, does nothing. Am I overlooking something simple here?
As a side note, I even went so far as to set priority on the stanzas as a test. No luck there either.
... View more
