topic Re: udp://514 input exclusion in Alerting

udp://514 input exclusion

joeybroesky — Wed, 23 Jun 2021 16:36:18 GMT

We have logs coming in udp port 514 and want to exclude indexing events with the field "action" equaling "accept". We have tried inserting the following into the inputs.conf but does not work.

blacklist = action = "accept"

Please assist.

Re: udp://514 input exclusion

venkatasri — Thu, 24 Jun 2021 00:47:21 GMT

Hi @joeybroesky

There seems no blacklist setting exist as per inputs conf - inputs.conf - Splunk Documentation

You can send the events to nullQueue to avoid indexing apply the following conf on HF/indexer.

#props.conf [your_udp_sourcetype/source::<source>/host::<hostname>] TRANSFORMS-null= setnull #transforms.conf [setnull] REGEX = action\s+=\s+\"accept\" DEST_KEY = queue FORMAT = nullQueue

----

An upvote would be appreciated and accept solution if it helps!

Re: udp://514 input exclusion

joeybroesky — Fri, 25 Jun 2021 18:47:17 GMT

Thanks for your help! This did exactly what I was looking for.