topic Re: Excluding events from Juniper SRX logs in Getting Data In

Excluding events from Juniper SRX logs

dsgoody — Tue, 22 Jul 2025 12:49:38 GMT

Hi all,

I'm having some issues excluding events from our Juniper SRX logs. These events are ingested directly on our Windows Splunk Heavy Forwarders, since these two firewalls are the only syslog inputs we have. My current config is as follows;

inputs.conf
[udp://firewallip:port]
connection_host = ip
disabled = false
index = juniper
sourcetype = juniper

props.conf
[udp://firewallip:port]
TRANSFORMS-null=TenantToTrust,TrustToTenant
force_local_processing = true

transforms.conf
[TenantToTrust]
REGEX = source-zone-name="tenant".*destination-zone-name="trust"
DEST_KEY = queue
FORMAT = nullQueue

[TrustToTenant]
REGEX = source-zone-name="trust".*destination-zone-name="tenant"
DEST_KEY = queue
FORMAT = nullQueue

All we'd like to do is exclude any events where the source and destination zones are both tenant or trust. Any idea where I might be going wrong?

Thanks.

Re: Excluding events from Juniper SRX logs

livehybrid — Tue, 22 Jul 2025 13:01:55 GMT

Hi @dsgoody

Firstly, the force_local_processing is only needed if you're running a Universal Forwarder. If its a Heavy Forwarder then you can safely remove this.

I think the main issue here is the stanza name - If you're referencing based on source then you need to use something like:

# props.conf [source::UDP:<port>]

Alternatively you can apply the transforms based on the sourcetype:

# props.conf [juniper]

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: Excluding events from Juniper SRX logs

dsgoody — Tue, 22 Jul 2025 13:22:57 GMT

That is working perfectly, thank you.