How to filter out any Meraki access point messages from being indexed in Splunk?

CrownIT — Mon, 28 Sep 2020 18:00:23 GMT

Hello everyone. I am new to SPlunk and syslog in general, but have gotten pretty far in the past week. I've got a Barracuda web filter and a Meraki MX90 sending data to Splunk with many reports and search built, so much that it has eliminated my need for the Barracuda admin panel.

My only problem is the Meraki MX90 sends two log entries for every URL accessed. This is because our wireless AP's are on the same system as the MX90, so I get two entries for every URL access as shown here:

Oct 23 08:58:13 xxx.xxx.xxx.xxx 1 1414069093.265104392 TBC_MX90 urls src=10.9.21.180:54043 dst=23.66.230.128:80 mac=xx:xx:xx:xx:xx:xx request: GET http://photos-b.ak.instagram.com/hphotos-ak-xaf1/10731741_xyz049522392569_653661020_n.jpg

Oct 23 08:58:13 xxx.xxx.xxx.xxx 1 0.0 Dorm_21_East_Repeater urls src=10.9.21.180:54043 dst=23.66.230.128:80 mac=xx:xx:xx:xx:xx:xx request: GET http://photos-b.ak.instagram.com/hphotos-ak-xaf1/10731741_xyz049522392569_653661020_n.jpg

We've got a ton of syslog data coming in, and there is absolutely no reason to keep the data from the access points in our database. Because I don't know exactly how to modify the various files, can someone please walk a dummy through preventing any message from my Meraki AP's from being indexed?

I figured the common phrase to look for in the raw event data to filter out ALL the AP's be "0.0 Dorm" since all the AP's are named similarly. Dorm_21_East_Repeater, Dorm_22_West_Gateway, Dorm_17_North_Repeater, etc...

This is the last hurdle I have with using Splunk effectively right now. It's been seven days, and four days I've reached the free trial license limits, and it's because of the extreme amount of data duplication. I've no doubt I will push to purchase a license, but our server space is at a premium. Thanks so much in advance for any help.

Rob Novak
The Crown College
Powell, TN

Re: How to filter out any Meraki access point messages from being indexed in Splunk?

richard_g_curry — Mon, 28 Sep 2020 18:35:37 GMT

This is rather old, have you got it figured out? If not ...

For your sourcetype, try this:

props.conf
[your_sourcetype]
TRANSFORMS-filter_dorm = filter_dorm

transforms.conf
[filter_dorm]
REGEX = 0.0\s+Dorm
DEST_KEY = queue
FORMAT = nullQueue

topic Re: How to filter out any Meraki access point messages from being indexed in Splunk? in Getting Data In

How to filter out any Meraki access point messages from being indexed in Splunk?

Re: How to filter out any Meraki access point messages from being indexed in Splunk?