topic Re: forward specified events to reciever in Getting Data In

forward specified events to reciever

khanlarloo — Sat, 18 Aug 2018 11:04:24 GMT

i need only recieve events with action=blocked from farwrders,

my logs are :
Aug 18 12:56:13 192.168.X.X date=2018-08-18 time=12:50:36 devname="XXX" logid="0001000014" type="traffic" subtype="local" level="notice" vd="root" eventtime=1534580436 srcip=192.168.x.x srcname="SPLUNK" srcport=138 srcintf="internal" srcintfrole="lan" dstip=192.168.x.x dstport=138 dstintf=unknown-0 dstintfrole="undefined" sessionid=76899473 proto=17 action="deny" policyid=0 policytype="local-in-policy" service="udp/138" dstcountry="Reserved"

i config my props.conf:

[host::192.168.X.X]
TRANSFORMS-null= setnull,setparsing

and transforms.conf

[setnull]
REGEX = .*
DEST_KEY = queue
FORMAT = nullQueue

[setparsing]
REGEX = (?m)^action=(blocked)
DEST_KEY = queue
FORMAT = indexQueue

but when i do this forwarder doesn't receive any logs from my device,can you tell me where is my mistake?

Re: forward specified events to reciever

jkat54 — Sat, 18 Aug 2018 16:33:31 GMT

Your regex in the setnull is too broad. .* will match everything. Thus sending everything to null queue, and never to indexes.

Your regex in setparsing is interesting.

REGEX = (?m)^action=(blocked)

This would only match events that begin with "action=blocked", but i dont understand why you have a capture group around (blocked).

Re: forward specified events to reciever

khanlarloo — Sat, 18 Aug 2018 18:42:48 GMT

i have problem when i do this i don't receive any logs from my device in forwarder
where is my mistake? is this configuration right?

Re: forward specified events to reciever

jkat54 — Sat, 18 Aug 2018 19:52:59 GMT

What are you trying to do?

Re: forward specified events to reciever

khanlarloo — Mon, 20 Aug 2018 03:49:01 GMT

i have one HF and i want to send specific field from my HF to receiver.
the field in my HF is action and i want HF just send field action=block to my receiver.

Re: forward specified events to reciever

jkat54 — Mon, 20 Aug 2018 11:53:06 GMT

Try changing transforms to this

 [setnull]
 REGEX = .*
 DEST_KEY = queue
 FORMAT = nullQueue

 [setparsing]
 REGEX = action\=blocked
 DEST_KEY = queue
 FORMAT = indexQueue

Re: forward specified events to reciever

khanlarloo — Sun, 26 Aug 2018 05:56:22 GMT

i do this in my HF but it doesn't work.

Re: forward specified events to reciever

jkat54 — Sun, 26 Aug 2018 11:30:49 GMT

In your transforms, try putting nullQueue 2nd

TRANSFORMS-null= setparsing, setnull

Make sure you reload the data to see the effect