topic Re: Regex - Filtering out unwanted events doesn't work in Splunk Search

Regex - Filtering out unwanted events doesn't work

moey — Tue, 29 Sep 2020 20:53:29 GMT

Raw Cisco WSA squid event:

1533849492.277 0 192.168.1.11 TCP_DENIED/307 0 GET http://detectportal.firefox.com/success.txt - NONE/- - OTHER-NONE-AuthenticatedUsers-NONE-NONE-NONE-NONE <-,-,-,"-",-,-,-,-,"-",-,-,-,"-",-,-,"-","-",-,-,-,-,"-","-","-","-","-","-",0.00,0,-,"-","-",-,"-",-,-,"-","-",-,-,"-"> -

props.conf

[cisco:wsa:squid]
TRANSFORMS-null = tcpdenied307-firefox

transforms.conf

[tcpdenied307-firefox]
REGEX = .+(TCP_DENIED).+(307).+(detectportal.firefox.com).+
DEST_KEY = queue
FORMAT = nullQueue

Any ideas why my REGEX doesn't work?

Re: Regex - Filtering out unwanted events doesn't work

MuS — Thu, 09 Aug 2018 21:58:45 GMT

Hi there,

the regex works fine. Here are a few things to check:

Did you apply the props.conf / transforms.conf on the parsing instance (the first full Splunk instance that receives the events)?
Did you restart that Splunk instance after you applied the props/transforms?
no typo in the sourcetype name?
maybe use TRANSFORMS-nullQueue-tcpdenied307-firefox = tcpdenied307-firefox just to make sure the <class> is uniq.
it only applies to new data coming in, not historical data

cheers, MuS

Re: Regex - Filtering out unwanted events doesn't work

moey — Thu, 09 Aug 2018 22:07:01 GMT

Hi,

Yes, I deployed the props and transforms from my master node to my indexers and I can see them.
According to the bundle distribution, I don't need to Splunk indexers.
no typo, we've had successfully filter out unwanted events in the past similar to what I'm trying to do right now
let me try that and see if it makes a difference
yes, i'm still seeing in the new incoming data and it's weird that it's not working. we've done it before.

Thanks.

Re: Regex - Filtering out unwanted events doesn't work

niketn — Fri, 10 Aug 2018 02:30:51 GMT

@moey check file permissions on props.conf and transforms.conf. It should be read only. You can compare file permission with other similar configurations.