I have noticed that my vmware logs which are forwarded to my HF via TCP are very large.  We would like to filter out a total sourcetype from being forwarded to the search heads.  I have read the docs out there and understand that we should add items to the props.conf and transforms.conf.  These should be in :  \$SPLUNK_HOME\Splunk\etc\system\local.  These two files were not here, but I added him.  Here is an example of what the file contains: props.conf [vmware:xxx:kernel] TRANSFORMS-routing = kernel_filter_routing transforms.conf [kernel_filter_routing] REGEX = . DEST_KEY = queue FORMAT = nullQueue   This does not appear to work. as I am still getting events in my search head from vmware:xxx:kernel.  Do I need to do something different as it a TCP data input? ... View more