nullqueue regex not working as expected

Applicability

Splunk Enterprise

Description

We have several use cases where we implement this "Keep specific events and discard the rest" pattern. 
https://docs.splunk.com/Documentation/SplunkCloud/6.6.3/Forwarding/Routeandfilterdatad#Keep_specific_events_and_discard_the_rest

We bumped into a case where we had null queue transformations defined as below in our indexers. We have verified this regex matches to all of our events. Then XXX matches the subset of events we want to keep and send to <INDEX> index. 

Transforms:

[YYY]
REGEX = .*LogName=Security.*
DEST_KEY = queue
FORMAT = nullQueue[XXX]
REGEX=(?msi)^EventCode=(<NUMBERS IN A REGEX>)
DEST_KEY = _MetaData:Index
FORMAT = <INDEX>

Props:

[WinEventLog:Security]
TRANSFORMS-set=YYY, XXX

This did not work. We had nothing in <INDEX>. Then when we changed YYY regex to "REGEX=." it worked ok. However, we should be able to REGEX nullque with more specific regexp than "." when it actually matches all the events.

Investigation

Comparing user's conf with the documentation it was noticed that all working diagrams started with a catchall testing. We can have multiple extractions from the catchall allowing the user to be as granular with the catchall in place.

https://docs.splunk.com/Documentation/SplunkCloud/6.6.3/Forwarding/Routeandfilterdatad#Keep_specific_events_and_discard_the_rest

Resolution

Set up props and transformations to have first nullqueue transformation with some regex other than ".". Then another transformation with more specific regex and some index and expect the data to go to that index.

Transforms:

[XXX]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue[YYY]
REGEX=(?msi)^EventCode=(<NUMBERS IN A REGEX>)
DEST_KEY = _MetaData:Index
FORMAT = <INDEX>[ZZZ]
REGEX= <LOG NAME REGEX>
DEST_KEY = _MetaData:Index
FORMAT = <DIFFERENT INDEX>

Props:

[WinEventLog:Security]
TRANSFORMS-set=XXX, YYY, ZZZ

Related Links

Splunk Documentation
Keep specific events and discard the rest:
https://docs.splunk.com/Documentation/SplunkCloud/6.6.3/Forwarding/Routeandfilterdatad#Keep_specific_events_and_discard_the_rest

Revision History

Revision	Publish Date	Comments
1.0	28-Sep-2026	Initial Release