Filtering CISCO events on Forwarder

[pfabrizi]

I have a CISCO monitor file log on a lightweight forwarder. We want to blacklist specific events, like teardowns and builds. Is this down in the props.conf stanza or can I use a transform.conf and send those to nullque or does this go into the inputs.conf file?

Not sure where to do this.

Thanks!

[mayurr98]

hey try this

Discard specific events and keep the rest
This example discards all teardowns and builds events in /var/log/messages by sending them to nullQueue:

1) In props.conf, set the TRANSFORMS-null attribute:

[source::/var/log/messages]
TRANSFORMS-null= setnull,setnull1

2) Create a corresponding stanza in transforms.conf. Set DEST_KEY to "queue" and FORMAT to "nullQueue":

[setnull]
REGEX = teardowns 
DEST_KEY = queue
FORMAT = nullQueue

[setnull1]
REGEX = builds
DEST_KEY = queue
FORMAT = nullQueue

3) Restart Splunk Enterprise.
Have a look at this doc for more info:
http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/Forwarding/Routeandfilterdatad#Discard_specif...

let me know if this helps!

[pfabrizi]

Here is what I tried and it didn't work:
Input.conf:
[monitor:///trvapps/logs/cisco]
sourcetype = cisco:asa
index = network
disabled = 0

Props.conf:
[source::/trvapps/logs/cisco]
EXTRACT-serial_number = Certificate was successfully validated. serial number:\s+([0-9A-Z]+).*
EXTRACT-user = Certificate was successfully validated. serial number:.\s[0-9A-Z]+\,\ssubject\sname:\s+cn=([A-Z0-9a-z]+)\,.
TRANSFORMS = cisco-setnull
TRANSFORMS = cisco-extractions

transform.conf:
[cisco-setnull]
REGEX =[A-Za-z]+\s\d+:\d+:\d+:\s[a-zA-Z]+\s %ASA-\d-302013:.*
DEST_KEY=queue
FORMAT = nullQueue

[cisco-extractions]
REGEX = %ASA-7
DEST_KEY = queue
FORMAT = nullQueue