Question on dropping certain syslog events

BrendanCO — Mon, 26 Oct 2020 22:38:56 GMT

Hi guys. I've got both Palo Alto and Fortinet logs coming in to my Splunk instances and have the appropriate apps set up for each. The thing I'd like to do is see if there are any chatty and mostly useless events I can have Splunk drop and not process before it is received and counted against my license. Palos are pretty good about how to trim in the FW itself but the Fortinet isn't quite as granular.

Is there something I can put an inputs.conf file (or another similar app conf file) that will tell it to just drop an incoming event if it contains X?

Re: Question on dropping certain syslog events

gcusello — Tue, 27 Oct 2020 07:12:58 GMT

Hi @BrendanCO,

it isn't possible to filter data on inputs.conf, with the only exception of wineventlogs.

So, you have to analyze your logs and find a rule (to transform in a regex) to exactly identify the logs to discard: e.g. if you found that the events in the sourcetype "your_sourcetype" containing the string "INFO" are to drop before indexing, you can create a rule in props.conf and transforms.conf like this:

props.conf

[your_sourcetype] TRANSFORMS-drop_PA_events = drop_PA_events

transforms.conf

[drop_PA_events] REGEX = INFO DEST_KEY = queue FORMAT = nullQueue

Remember that these props.conf and transforms.conf must be on Indexers and (when present) on Heavy Forwarders.

You can find more infos at https://docs.splunk.com/Documentation/Splunk/8.1.0/Forwarding/Routeandfilterdatad#Filter_event_data_and_send_to_queues

Ciao.

Giuseppe

topic Re: Question on dropping certain syslog events in Getting Data In

Question on dropping certain syslog events

Re: Question on dropping certain syslog events