Hello,   We have wmi.conf in place like below [WMI:services] wql = SELECT * FROM Win32_Process where Name like '%search%' OR Name like '%w3wp%' interval = 300 disabled = 0 server = TestIN001 We wants to have events with environment like prod, stage & test and i have tried like below also but no luck [WMI:services] wql = SELECT * FROM Win32_Process where Name like '%search%' OR Name like '%w3wp%' interval = 300 disabled = 0 server = TestIN001 _meta = environment::prod   Kindly help me on this if it is feasible somehow.     ... View more

I was wondering why all of the filters implemented are not working. Below is my props.conf & transforms.conf file props.conf [source::L:\\sample\\logs\\collections...*>] TRANSFORMS-set= samplecollectionlogs [source::L:\\sample\\logs\\(?:commands|webapps|partions)...*>] TRANSFORMS-set1= samplecommandlogs [source::L:\\sample\\logs\\engines...*>] SEDCMD-maskfilterlist = s/\(\(not\(deniedlist1 in \('.*'\)\)\)\) /((not(deniedlist1 in ('_content_removed_by_splunk')))) /   transforms.conf   [samplecollectionlogs] REGEX = (^\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2}\s(\{\d+\}\s)?(mapping|custom|TreePrefixBuilder|XB|ScdLookup|\s|\})|^[^0-9\]]) DEST_KEY = queue FORMAT = indexQueue [samplecommandlogs] REGEX = . DEST_KEY = queue FORMAT = nullQueue   Also my doubts is L:\\sample\\logs path are not defined in my heavy splunk(i.e where my props & transforms file reside) but these paths are defined in inputs of the universal forwarders. Source will also consider the monitor path from universal forwarders or should i define in heavy forwarder as well       ... View more