Disable Indexing of Results

[kcsixers]

Hey Luke,

First and foremost, great App! The whois is working well for my needs!

Would it be possible to add the ability to disable indexing of the results from the search commands? Maybe it's already a setting that I've missed but adjusting the index setting to "nothing" still resulted in events in the main index.

Thanks,
Casey

[tkoeberl]

should already be possible wiht a workaround:
local/props.conf

[stash_output]
TRANSFORMS-send-data-to-null-queue = network_tools_setnull

local/transforms..conf

[network_tools_setnull]
REGEX = .*
DEST_KEY = queue
FORMAT = nullQueue

[tkoeberl]

What's more or less an issue here is the name of the sourcetype: "stash_output"
thats a bit to general and coudl possibly be used somewhere else and then you could loose events you would like to have it to be indexed.

[tkoeberl]

this should fix that was well:
props.conf

[stash_output]
TRANSFORMS-send-data-to-null-queue = network_tools_setnull

transforms.conf

[network_tools_setnull]
SOURCE_KEY=MetaData:Source
REGEX = speedtest_search_command|wakeonlan_search_command|ping_search_command|traceroute_search_command|whois_search_command|nslookup_search_command|portscan_search_command
DEST_KEY = queue
FORMAT = nullQueue