This is a weird situation. I have on a number of Windows hosts running the heavyweight forwarder the following in local\props.conf [WinEventLog:Security] TRANSFORMS-null = setnull and in local\transforms.conf [setnull] REGEX = (?msi)^EventCode=(5152|5157)\b DEST_KEY = queue FORMAT = nullQueue That's been in place for about six months and was working as expected across all hosts (we did not see those codes in the indexer). A couple months ago, one host was rebuilt and inadvertently, the windows app was not installed. Recently we had a flood of the above two events, plus another, 5447, from that particular host. I updated transforms.conf to add the 5447 event (propgated to all other hosts) and added the windows app to the one that was missing it (and restarted splunk all around). All the other hosts are behaving as expected. That one host is still sending the 5152, 5157 and 5447 events. I've gone so far as to remove and reinstall splunk on it but it's still sending them. What could be going wrong? ... View more