topic Re: How to reduce the cisco ASA logs using regex? in Splunk Search

How to reduce the cisco ASA logs using regex?

kiran331 — Fri, 16 Jun 2017 14:11:15 GMT

Hi,

Is there a way to ignore a event containing the message before indexing using regex in props.conf and transforms.conf

ignore the msg contains "10.11.12.133 to 10.11.12.134 "?

Re: How to reduce the cisco ASA logs using regex?

somesoni2 — Fri, 16 Jun 2017 14:47:26 GMT

You can follow instructions from below link on dropping specific events ( containing those IP addresses) and index the rest.

http://docs.splunk.com/Documentation/Splunk/6.5.2/Forwarding/Routeandfilterdatad#Discard_specific_events_and_keep_the_rest

On INdexer/Heavy Forwarder (whichever comes first in flow)
In props.conf, set the TRANSFORMS-null attribute:
[

[YourSourceTypeNameHere]
TRANSFORMS-null= setnull

Create a corresponding stanza in transforms.conf. Set DEST_KEY to "queue" and FORMAT to "nullQueue":

[setnull]
REGEX = (10\.11\.12\.133|10\.11\.12\.134)
DEST_KEY = queue
FORMAT = nullQueue

Restart Splunk Enterprise.

Re: How to reduce the cisco ASA logs using regex?

woodcock — Fri, 16 Jun 2017 14:58:17 GMT

When you say "ignore" do you mean "prevent from being indexed" or "once indexed, prevent from showing in my search"?

Assuming the former:

http://docs.splunk.com/Documentation/Splunk/6.6.1/Forwarding/Routeandfilterdatad#Filter_event_data_and_send_to_queues

Re: How to reduce the cisco ASA logs using regex?

kiran331 — Fri, 16 Jun 2017 16:07:14 GMT

Hi somesoni2,

I added this on Heavy Forwarder and also On indexers, I changed it to ignore any logs containing 169.244.255.255. I still see the logs indexing,

I added the below in props.conf and transforms.conf.

props.conf

[cisco:asa]
TRANSFORMS-null= setnull

[setnull]
REGEX = (169.254.255.255)
DEST_KEY = queue
FORMAT = nullQueue

Re: How to reduce the cisco ASA logs using regex?

horsefez — Fri, 16 Jun 2017 16:28:32 GMT

Hi,
maybe try to "escape" the dots in your regex.

Like this: (169\.254\.255\.255)

Re: How to reduce the cisco ASA logs using regex?

kiran331 — Fri, 16 Jun 2017 16:45:13 GMT

Hi,

I'm using . , It was changed in the comment.

Re: How to reduce the cisco ASA logs using regex?

somesoni2 — Fri, 16 Jun 2017 16:48:34 GMT

Did you restart Splunk after making the change? ALso, this filter will be applicable for any data that'll come after you made the change, any older data would remain as is.

Re: How to reduce the cisco ASA logs using regex?

kiran331 — Fri, 16 Jun 2017 17:00:30 GMT

Thank you it worked.

Re: How to reduce the cisco ASA logs using regex?

kiran331 — Tue, 20 Jun 2017 18:10:57 GMT

Hi,

I also have 2 more IP's to avoid before Indexing, 169.225.1.2.3 and 165.244.253.255, Do I have to create new stanza Or I can use the old one to add Ip's?

Re: How to reduce the cisco ASA logs using regex?

horsefez — Thu, 22 Jun 2017 15:37:43 GMT

just add them to the existing stanza like this

(10\.11\.12\.133|10\.11\.12\.134|<next-ip>|<next-ip>)

Re: How to reduce the cisco ASA logs using regex?

kiran331 — Thu, 22 Jun 2017 16:01:42 GMT

Thank you