Good afternoon. When filtering events before indexing there is something wrong, because for unknown reasons this filter is not being applied correctly and events are still being sent which should be discarded. The configuration I have in the props and transforms files is the following (this filter has been applied both locally, and in the default and local folders of the corresponding app)   [props] [traffic] (This would be the sourcetype through which these events pass.) TRANSFORMS-null= filter_to_null   [transforms] [filter_to_null] REGEX = (?:6|7)\.company.com\.es\s\d(?:[^,]*,){25}(?!53|389|3389|445|20|21|22|23|80|8443|8080|443) DEST_KEY = queue FORMAT = nullQueue   I have seen different forums but I can't find the problem and in principle the regex does work as it has been tested on different sites and on splunk itself. ... View more