topic Re: Filter events while sending data from Heavy Forwarder to Indexer in Getting Data In

Filter events while sending data from Heavy Forwarder to Indexer

rodneyjerome — Tue, 09 Feb 2021 08:55:00 GMT

Hi,

I have an HFW and indexer in my environment. I'm looking to filter certain events from the log source in HFW based on REGEX while indexing in the indexer.

Please find below the config files. Not sure where I'm going wrong.

props.conf

[testing]

TRANSFORMS-routing = conGroup

inputs.conf

[monitor:///var/logs]

disabled = false

index = main

sourcetype =. testing

host = HFW

transforms.conf

[conGroup]

REGEX = ^(((?!i-)(?!sample)).)*$

DEST_KEY=_TCP_ROUTING

FORMAT=test

outputs.conf

[tcpout]

defaultGroup = nothing

[tcpout:test]

server = X.X.X.X:9997

Any help will be. much appreciated. Thanks in advance

Re: Filter events while sending data from Heavy Forwarder to Indexer

scelikok — Tue, 09 Feb 2021 08:20:06 GMT

Hi @rodneyjerome,

On your props.conf TRANSFORM is pointing to wrong stanza.

Please try this;

[testing] TRANSFORMS-routing = conGroup

Re: Filter events while sending data from Heavy Forwarder to Indexer

gcusello — Tue, 09 Feb 2021 08:29:32 GMT

Hi @rodneyjerome,

let me understand: do you want to send only a part of logs to Indexers or discard eventd?

Anyway the location of your filters is only the HF, On Indexers arrive already parsed events so it isn't possible filter them.

You can find the way to filter events at https://docs.splunk.com/Documentation/SplunkCloud/8.1.2012/Forwarding/Routeandfilterdatad#Filter_event_data_and_send_to_queues

Ciao.

Giuseppe

Re: Filter events while sending data from Heavy Forwarder to Indexer

rodneyjerome — Fri, 19 Feb 2021 08:26:45 GMT

Thanks. This worked great!