Based upon your config, I went and troubleshot a little further. It looks like my issue is actually related to the setNull stanza in transforms.conf. I moved setNull to the end of the transform list in props.conf, and now events are routing properly, but there is no filtering happening (Event codes I specified and event codes I didnt specify are being routed). To troubleshoot why this happened, I went to my indexer, and tried separating EventCodes into separate indexes using the same REGEX as above, while keeping setNull to the end of my list. In doing so, the data was going to the proper index, but if it didnt meet any of the Event Code criteria, it got dumped into the main index, even though I have the setNull stanza in place. This behavior only applied while setNull was at the end of the props.conf transform list. (it is still the first entry in transforms.conf). This changes to not indexing any events at all once setNull is moved to the beginning of the transform list. Upon reviewing the splunk documentation (specifically Route and Filter Data), I noticed there is never a mix of DEST_KEY in any props.conf stanza transform lists. So, the question now is: Can I only specify one type of DEST_KEY in transforms.conf per stanza in props.conf? If so, what is the suggested way around this limitation?
... View more