Noting your input on the SH being not the best option for the input collector of HEC. Anyway, your tip was the correct one and allowed to filter the data. You made my day, thanks ! ... View more

I'm receiving the HEC directly on the search head and have the props/transforms setup on both the SH and the indexers. The sourcetype is "jenkins_log" and the log I want to avoid has "DBCompilation" in the source field This is what I'm trying to achieve. in props.conf:     [jenkins_log] TRANSFORMS-override = ignore_jenkins_logs   in transforms.conf   [ignore_jenkins_logs] SOURCE_KEY = fields:source REGEX = DBCompilation DEST_KEY = queue FORMAT = nullQueue   ... View more

Hello , did you find a solution for this problem ? I'm facing the same issue and the data coming from HEC is never dropped. ... View more