Hi Splunkers I'm new to splunk and currently playing around with the heavy forwarder. I found here several examples how to match a specific string in an event and only forward that event to the indexer. However, I could not find the opposite. Here is what I would like to do. Let's say in /var/log/messages we have those two log entries: May 7 08:00:14 <host> <user>: Splunk, get that line! May 7 08:01:45 <host> <user>: Splunk, miss that line! My props.conf contains: [source::/var/log/messages] TRANSFORMS-set=setnull,ignore My transforms.conf contains: [setnull] REGEX = . DEST_KEY = queue FORMAT = nullQueue [ignore] REGEX = !miss DEST_KEY = queue FORMAT = indexQueue I have tryed several regex for the NOT miss part. So far I have not found any solution. Again, my goal is not to match the first line. I know how that is done. I want to match everything except something with a key word. At the end I should be able to exclude known events and always receive on my indexer what is wanted or sofar unknown. Thank you for your help ... View more