How to solve setnull issue while filtering required events?

roopeshetty — Wed, 11 Jan 2023 16:58:31 GMT

Hi ,

We are getting lot of events into our Splunk which is filling up the our computer disk storage rapidly.

Our search query is “index="cloud" sourcetype=sls_sourcetype”

Upon investigating we decided that we need to capture only below events;

Collect only below events Where field name “sql” contains below 4 values ;

logout!

login success!

login failed!

create

Actually field name “sql” contains more than 100 values so we need to exclude all of them and capture only those events which has mentioned above 4 values.

We tried below configurations in transforms.conf and props.conf files but none of them are giving desired results. Can some please help us with the correct settings as this is the first time we are working transforms.conf and props.conf settings.

transforms.conf as below;

[setnull]

SOURCE_KEY=_raw

REGEX = *

DEST_KEY = queue

FORMAT = nullQueue

[setqueue]

SOURCE_KEY=_raw

REGEX = sql=log(out! |in success! |in failure!)

DEST_KEY = queue

FORMAT = indexQueue

Props.conf as below;

[sourcetype::sls_sourcetype]

TRANSFORMS-set= setnull,setparsing

Re: setnull issue while filtering required events

PaulPanther — Tue, 10 Jan 2023 10:09:44 GMT

@roopeshetty There is a typo in your props.conf. The stanza setparsing does not exist.

[sls_sourcetype] TRANSFORMS-set=setnull,setqueue

and rewrite your setnull stanza

[setnull] SOURCE_KEY=_raw REGEX = . DEST_KEY = queue FORMAT = nullQueue

If it still does not work verify your regex with regex101: build, test, and debug regex.

topic Re: setnull issue while filtering required events in Getting Data In

How to solve setnull issue while filtering required events?

Re: setnull issue while filtering required events