https://community.splunk.com/t5/Getting-Data-In/How-to-filter-out-certain-events-from-checkpoint-data/m-p/245034#M47375 <P>Sorry, corrected.</P> <P>See image:</P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/1128i59C57C64FDE5CD52/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> <P>I tried including the props.conf otherwise specified, but could not figure out if my props file or transforms is incorrect or even both.</P> Thu, 10 Mar 2016 15:17:10 GMT rodrigorsilva 2016-03-10T15:17:10Z https://community.splunk.com/t5/Getting-Data-In/How-to-filter-out-certain-events-from-checkpoint-data/m-p/245030#M47371 <P>Hi everyone,</P> <P>I need help to create a better regex in my transforms.conf. I am filtering checkpoint data in my Splunk.</P> <P>In this case, I don't want collect the following event policy_name=firewall_name</P> <P>I created the props.conf and transforms.conf:</P> <PRE><CODE> props.conf: [script:///splunk/splunk/etc/apps/Splunk_TA_opseclea_linux22/bin/lea-loggrabber.sh --configentity SplunkLEA] TRANSFORMS-null = eliminate_opsec transforms.conf [eliminate-opsec] REGEX = policy_name\=firewall_name DEST_KEY = queue FORMAT = nullQueue </CODE></PRE> <P>How do I do add this function ?</P> Tue, 29 Sep 2020 09:04:41 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-filter-out-certain-events-from-checkpoint-data/m-p/245030#M47371 rodrigorsilva 2020-09-29T09:04:41Z https://community.splunk.com/t5/Getting-Data-In/How-to-filter-out-certain-events-from-checkpoint-data/m-p/245031#M47372 <P>Hi,</P> <P>Have you restarted splunk daemon?</P> <P>Hope help you</P> Thu, 10 Mar 2016 14:24:02 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-filter-out-certain-events-from-checkpoint-data/m-p/245031#M47372 jmallorquin 2016-03-10T14:24:02Z https://community.splunk.com/t5/Getting-Data-In/How-to-filter-out-certain-events-from-checkpoint-data/m-p/245032#M47373 <P>HI,</P> <P>Yes, i tried this, but not worked.</P> <P>Rodrigo Ribeiro</P> Thu, 10 Mar 2016 14:37:39 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-filter-out-certain-events-from-checkpoint-data/m-p/245032#M47373 rodrigorsilva 2016-03-10T14:37:39Z https://community.splunk.com/t5/Getting-Data-In/How-to-filter-out-certain-events-from-checkpoint-data/m-p/245033#M47374 <P>Hi,</P> <P>Reviewing your configuration there is a mistake about the name of the transform.</P> <P>eliminate_opsec vs eliminate-opsec</P> <P>They have to be the same.</P> <P>Hope i help you.</P> Thu, 10 Mar 2016 15:13:18 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-filter-out-certain-events-from-checkpoint-data/m-p/245033#M47374 jmallorquin 2016-03-10T15:13:18Z https://community.splunk.com/t5/Getting-Data-In/How-to-filter-out-certain-events-from-checkpoint-data/m-p/245034#M47375 <P>Sorry, corrected.</P> <P>See image:</P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/1128i59C57C64FDE5CD52/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> <P>I tried including the props.conf otherwise specified, but could not figure out if my props file or transforms is incorrect or even both.</P> Thu, 10 Mar 2016 15:17:10 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-filter-out-certain-events-from-checkpoint-data/m-p/245034#M47375 rodrigorsilva 2016-03-10T15:17:10Z https://community.splunk.com/t5/Getting-Data-In/How-to-filter-out-certain-events-from-checkpoint-data/m-p/245035#M47376 <P>Hello everyone</P> <P>We had successfully with the informed documentation, see below how the files were edited:</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.2.3/Forwarding/Routeandfilterdatad" target="_blank">http://docs.splunk.com/Documentation/Splunk/6.2.3/Forwarding/Routeandfilterdatad</A><BR /> <A href="https://answers.splunk.com/answers/99636/need-help-with-nullqueue-specifics-included.html" target="_blank">https://answers.splunk.com/answers/99636/need-help-with-nullqueue-specifics-included.html</A></P> <UL> <LI><P>props.conf<BR /> [opsec]<BR /> TRANSFORMS-null = setnullopsec</P></LI> <LI><P>transforms.conf<BR /> [setnullopsec]<BR /> REGEX = policy_name=(FIrewall_1|Firewall_2)<BR /> DEST_KEY = queue<BR /> FORMAT = nullQueue</P></LI> </UL> <P>Thank you very much.</P> <P>Rodrigo Ribeiro</P> Tue, 29 Sep 2020 09:07:32 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-filter-out-certain-events-from-checkpoint-data/m-p/245035#M47376 rodrigorsilva 2020-09-29T09:07:32Z