topic Re: Using And condition between two different SOURCE_KEY in a stanza inside transforms.conf or in props.conf in Getting Data In

Using And condition between two different SOURCE_KEY in a stanza inside transforms.conf or in props.conf

jorcabro — Wed, 18 Sep 2019 13:47:32 GMT

Hi,

I want to filter out Checkpoint events based on two different conditions:

It comes from a specific IP XX.XX.XX.XX, I have this information in host metadata field.
The action field after parsing the _raw can't be equal to allowed.

I can filter out these two conditions separately with stanzas like this:

[parse-action]
REGEX = action=accept
DEST_KEY = queue
FORMAT = nullQueue

[parse-hosts]
SOURCE_KEY = MetaData:Host
REGEX = (xx.xx.xx.xx|yy.yy.yy.yy)
DEST_KEY = queue
FORMAT = nullQueue

But I need that both of them are true at the same time, so I need to do an and between them.

How could I acomplish this?

Ps. I don't have the host info anywhere in the _raw data, so I can't use the same regex

Edit: Another approach will be to add the and condition in props.conf. This is the configuration right now:

TRANSFORMS-checkpoint_events = parse-action, parse-hosts

Instead of telling it to apply this after this, I want to apply this AND this

Re: Using And condition between two different SOURCE_KEY in a stanza inside transforms.conf or in props.conf

rupesh26 — Fri, 20 Sep 2019 04:21:04 GMT

what's the difference ? the below works for you isn't ?
TRANSFORMS-checkpoint_events = parse-action, parse-hosts

Re: Using And condition between two different SOURCE_KEY in a stanza inside transforms.conf or in props.conf

jorcabro — Mon, 23 Sep 2019 16:03:45 GMT

But that applies both of the transforms no matter what.
I only want to apply the tranforms if, and only if, both of the conditions are true. That means traffic from host xxxx AND accepted not traffic from host xxxx OR traffic accepted.

Re: Using And condition between two different SOURCE_KEY in a stanza inside transforms.conf or in props.conf

rupesh26 — Wed, 25 Sep 2019 05:42:08 GMT

Think its tricky, as per the configurations the transforms are applied in order. So in any case both conditions would apply. So I don't think its achievable. You can raise a case to Splunk and see if there is a solution for this.

Meanwhile if you can add the host as well to the _raw events that is also a workaround.