I have some json coming in from syslog and there's a bunch of added junk that's inhibiting the field extraction. I tried  transforms.conf [eliminate_header] REGEX=s/^[^{]+//g DEST_KEY=queue FORMAT=nullQueue and props.conf [syslog_cue] TRANSFORMS-t1=eliminate_header and a couple other things but can't quite seem to get the outcome I want. Testing the regex works, but isn't helping in the way I need it to.  ... View more

I have a filter built from: http://docs.splunk.com/Documentation/Splunk/7.0.2/Forwarding/Routeandfilterdatad and https://www.splunk.com/blog/2012/09/21/the-splunk-app-for-active-directory-and-how-i-tamed-the-security-log.html transforms.conf [dumpFirewallEvents] REGEX=(?m)EventCode=(5156|5157) DEST_KEY = queue FORMAT=nullQueue props.conf [source::wineventlog:security] TRANSFORMS-firewall = dumpFirewallEvents I'm stilling seeing the events 5156 in splunk and it's flooding the index quota ... View more