you have to specify in your regex expression at tranforms.conf what is the counters you don't want to index, otherwise, it will through away the entire sourcetype. I believe in your case, you have to create more than one regex expression to match the counters you want to drop from indexing. something like this: [typeyoursourcetypeherefor-vmware] TRANSFOMRS-Filterdatacount1=filtercount1 TRANSFOMRS-Filterdatacount1=filtercount2 transforms.conf [filtercount1] REGEX =(?msi)vmware:perf\S(change the regex to match the sourcetype/counter) DEST_KEY = queue FORMAT = nullQueue [filtercount2] REGEX =(?msi)vmware:perf\S(change the regex to match the sourcetype/counter) DEST_KEY = queue FORMAT = nullQueue
... View more