https://community.splunk.com/t5/Splunk-Enterprise-Security/Discarding-Specific-type-of-traffic-either-on-forwarder-or/m-p/497361#M8655 <P>please try this one: <A href="https://regex101.com/r/wgNicw/1">https://regex101.com/r/wgNicw/1</A></P> <P>transforms.conf<BR /> [discardsnmp]<BR /> REGEX = \b(\w[a-zA-Z].*\Dapp=SNMP.+)<BR /> DEST_KEY = queue<BR /> FORMAT = nullQueue</P> Tue, 15 Oct 2019 00:15:06 GMT ivanreis 2019-10-15T00:15:06Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Discarding-Specific-type-of-traffic-either-on-forwarder-or/m-p/497360#M8654 <P>Discarding Specific type of traffic either on forwarder or indexer fails, I tried to discard it using blacklist on forwarder and nullqueue transform on indexer and both failed.</P> <P>here is a log sample</P> <P>Oct 3 11:34:03 1.1.1.1 CEF:0|FORCEPOINT|Firewall|6.5.1|70018|Connection_Allowed|0|app=SNMP (UDP) rt=Oct 03 2019 11:28:12 deviceFacility=Packet Filtering act=Allow deviceOutboundInterface=13 deviceInboundInterface=0 proto=17 dpt=161 spt=62032 dst=2.2.2.2 src=3.3.3.3 dvchost=4.4.4.4 dvc=4.4.4.4 deviceExternalId=company-name node 1 cs1Label=RuleID cs1=2097272.10</P> <P>and the configuration</P> <P>props.conf<BR /> [forcepoint]<BR /> Transform-Forcepoint=discardsnmp</P> <P>transforms.conf<BR /> [discardsnmp]<BR /> REGEX = app=<EM>SNMP</EM><BR /> DEST_KEY = queue<BR /> FORMAT = nullQueue</P> <P>any one can find out what is the problem?</P> Thu, 03 Oct 2019 08:42:28 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Discarding-Specific-type-of-traffic-either-on-forwarder-or/m-p/497360#M8654 abwe 2019-10-03T08:42:28Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Discarding-Specific-type-of-traffic-either-on-forwarder-or/m-p/497361#M8655 <P>please try this one: <A href="https://regex101.com/r/wgNicw/1">https://regex101.com/r/wgNicw/1</A></P> <P>transforms.conf<BR /> [discardsnmp]<BR /> REGEX = \b(\w[a-zA-Z].*\Dapp=SNMP.+)<BR /> DEST_KEY = queue<BR /> FORMAT = nullQueue</P> Tue, 15 Oct 2019 00:15:06 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Discarding-Specific-type-of-traffic-either-on-forwarder-or/m-p/497361#M8655 ivanreis 2019-10-15T00:15:06Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Discarding-Specific-type-of-traffic-either-on-forwarder-or/m-p/497362#M8656 <P>Thanks, it worked like charm</P> Sun, 20 Oct 2019 09:34:40 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Discarding-Specific-type-of-traffic-either-on-forwarder-or/m-p/497362#M8656 abwe 2019-10-20T09:34:40Z