Getting Data In

Can you help me with my data filtering query?

satyaallaparthi
Communicator

I am trying to filter the data sourcetype= WinEventLog:Microsoft-Windows-Sysmon/Operational , sourcetype=WinEventLog:Microsoft-Windows-Sysmon/Operational and the source = E:\Eam\Siteminder\Log\smps.log. These are being sent by some one else to my Splunk instance and I don't want to receive any of the above data from any server. I wrote transforms.conf and props.conf in the heavy forwarder, but still, I am getting that data from all those...

*props.conf *

[WinEventLog:Microsoft-Windows-Sysmon/Operational]
TRANSFORMS-call = noncommon

[WinEventLog:Microsoft-Windows-System]
TRANSFORMS-call = common

[source::*smps.log]
TRANSFORMS-call = filter

transforms.conf :

[noncommon]
SOURCE_KEY = MetaData:Sourcetype
REGEX = Sysmon
DEST_KEY = queue
FORMAT = nullQueue

[common]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue

[filter]
SOURCE_KEY = MetaData:Source
REGEX = smps
DEST_KEY = queue
FORMAT = nullQueue

[accepted_keys]
is_valid=_SYSLOG_ROUTING

1 Solution

markusspitzli
Communicator

For filtering events like you want you simply have to create one rule, but you have to define source::

props.conf

[source::WinEventLog:Microsoft-Windows-Sysmon/Operational]
TRANSFORMS-call = drop

[source::WinEventLog:Microsoft-Windows-System]
TRANSFORMS-call = drop

[source::E:\Eam\Siteminder\Log\smps.log]
TRANSFORMS-call = drop

transforms.conf

[drop]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue

Put those files on the indexers and restart it.

View solution in original post

0 Karma

markusspitzli
Communicator

For filtering events like you want you simply have to create one rule, but you have to define source::

props.conf

[source::WinEventLog:Microsoft-Windows-Sysmon/Operational]
TRANSFORMS-call = drop

[source::WinEventLog:Microsoft-Windows-System]
TRANSFORMS-call = drop

[source::E:\Eam\Siteminder\Log\smps.log]
TRANSFORMS-call = drop

transforms.conf

[drop]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue

Put those files on the indexers and restart it.

0 Karma

Rob2520
Communicator

@satyaallaparthi Can you confirm that the data in question is first reaching HF and then being forwarded to indexer(s)? Also, if you want all the data with sourcetype=WinEventLog:Microsoft-Windows-Sysmon/Operational to be sent to null queue, why don't you have REGEX set to . ? And same for smps. Try removing SOURCE_KEY in transforms and restart splunk.

0 Karma

satyaallaparthi
Communicator

Yes I did tried REGEX= . and removed the source_key aswell and restarted..and I dont wanna receive any data from those sourcetypes and source E://EAM* but still am getting data from those. Please help me with that.

thanks,

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...