ESS SEP, Check Point and TippingPoint TA Filters

ephemeric — Thu, 31 Mar 2011 19:40:35 GMT

Hi,

We're using the above and I was wondering if it is possible to filter out some unneeded event data to decrease index usage?

I've looked at the TA props and transforms quickly, it doesn't seem so obvious to me right now.

Thanks.

Re: ESS SEP, Check Point and TippingPoint TA Filters

hazekamp — Thu, 31 Mar 2011 23:14:24 GMT

ephemeric,

The ability to "null-queue" incoming data based on regular expression is native to Splunk. Since you have ESS in place you could put the props/transforms for your respective data sets in local directory of the TA. Keep in mind these are operations that are performed at index time, so those TA's should be pushed down to your indexers via deployment server.

## props.conf:
[tippingpoint]
TRANSFORMS-null_queue_for_tippingpoint = null_queue_for_tippingpoint

## transforms.conf:
[null_queue_for_tippingpoint]
REGEX = <your_regex_here>
DEST_KEY = queue
FORMAT = nullQueue

Here's some additional resources if needed:

http://answers.splunk.com/questions/11617/route-unwanted-logs-to-a-null-queue

http://www.splunk.com/base/Documentation/latest/Admin/Propsconf

http://www.splunk.com/base/Documentation/latest/Admin/Transformsconf

topic Re: ESS SEP, Check Point and TippingPoint TA Filters in Splunk Enterprise Security

ESS SEP, Check Point and TippingPoint TA Filters

Re: ESS SEP, Check Point and TippingPoint TA Filters