hi,  I have a heavy forwarder configured this way inputs.conf [udp://514] sourcetype = syslog index = abc connection_host = ip disabled = 0 _TCP_ROUTING =MyRoute So any server sending syslog on UDP 514 is hitting my heavy forwarder and getting sent to my indexers.  I want to block events from a set of servers, as I don't want them to be indexed. They are consuming my licenses.  I am trying to do this in props.conf and transforms.conf props.conf [host::XX.XX.XXX.XXX] TRANSFORMS-abc = drop_events and in my transforms.conf, I have this  [drop_events] REGEX =. DEST_KEY = queue FORMAT = nullQueue But this is not dropping the events from this server. I can still events being indexed real time when i search.  What am I doing wrong? I have a few more servers which I need to block this way.  Any help is greatly appreciated.  ... View more

Hello all, if anybody had luck running a blocking search using the C# SDK, would appreciate your help. I am trying to run a blocking search from a C# application. This is my code: ServicePointManager.ServerCertificateValidationCallback = delegate { return true; }; var service = new Service(new Uri("mySplunkURL:8089")); await service.LogOnAsync("username", "password"); SearchResultStream searchResultStream; Job job; job = await service.Jobs.CreateAsync( "search index=_internal | head 10" ,new JobArgs() { ExecutionMode = ExecutionMode.Blocking }); At this point, I get an error that says JobArgs does not contain a definition for 'ExecutionMode'  I am following the documentation on the Splunk site, and doing exactly same  https://dev.splunk.com/enterprise/docs/devtools/csharp/sdk-csharp/howdoicsharp2x/howtorunsearches I don't know what am I missing here? Any help is greatly appreciated !!  Vinay ... View more

Hi, I have a clustered environment where I have 1 indexer master/license master, 1 search head deployer, 3 search heads in search head cluster and 2 indexers in an indexer cluster. I have set up a monitoring console on the license master and changed it to distributed mode. I can see my indexers there, but I don't see my search heads. I followed the documentation and went to Settings -> Distributed Search -> Search Peers and tried doing add new search peer and provided my search head URL https://xxxxx1:8089 I added all my search heads, but when I add it, I see that the cluster label shows as indexercluster1 - that's my indexer cluster label. Why is my search head showing as an indexer cluster member when I add it here? Also, the replication status gets set to Initial when I add it and then changes to Successful. What is it replicating? And even after this, when I check the topology under search heads it's not showing any of the above machines that I added. I presume it's considering them as indexers as its showing the indexer cluster label. How do I fix this so that I can monitor my search heads and the search head deployer too through this monitoring console? Any help is greatly appreciated. ... View more