Create /opt/splunk/etc/system/local/transforms.conf if it does not exist.

[null1]※ REGEX = <正規表現A>※ DEST_KEY = queue FORMAT = nullQueue [null2]※ REGEX = <正規表現B>※ DEST_KEY = queue FORMAT = nullQueue

Setting example: When excluding events that include the character string msg=aaa or msg=bbb and importing

				[null1]
				REGEX =msg\=aaa
				DEST_KEY = queue
				FORMAT = nullQueue
				[null2]
				REGEX =msg\=bbb
				DEST_KEY = queue
				FORMAT = nullQueue;

supplement

• Be sure to save in UTF-8.
• In transforms.conf, "DEST_KEY" and "FORMAT" parts do not need to be changed.
• Regular expression A and regular expression B must contain regular expressions that match the strings you want to exclude.

* Please set the marked part (stanza name, regular expression) according to your company's environment.

[<source type name>]TRANSFORMS-null=null1,null2

Setting example: Setting for source type test

				[test]
				TRANSFORMS-null=null1,null2

supplement

• The above is the setting for the source type, but it can also be applied to the host and source in addition to the source type.
• Setting value description method TRANSFORMS-<unique class name>=<stanza name used in transforms.conf>
• Here, the class name is null, and null1 and null2 are used in the transforms.conf settings, so they are set on the right side of the equals, separated by commas.

【Notes】

• Configuration is done on the index server (or heavy forwarder). (Cannot be set on the universal forwarder)
• Only events that are captured after the setting is made are considered. Events that have already been captured will not be deleted.