Excluding events from Juniper SRX logs

[dsgoody]

Hi all,

I'm having some issues excluding events from our Juniper SRX logs. These events are ingested directly on our Windows Splunk Heavy Forwarders, since these two firewalls are the only syslog inputs we have. My current config is as follows;

inputs.conf
[udp://firewallip:port]
connection_host = ip
disabled = false
index = juniper
sourcetype = juniper

props.conf
[udp://firewallip:port]
TRANSFORMS-null=TenantToTrust,TrustToTenant
force_local_processing = true

transforms.conf
[TenantToTrust]
REGEX = source-zone-name="tenant".*destination-zone-name="trust"
DEST_KEY = queue
FORMAT = nullQueue

[TrustToTenant]
REGEX = source-zone-name="trust".*destination-zone-name="tenant"
DEST_KEY = queue
FORMAT = nullQueue

All we'd like to do is exclude any events where the source and destination zones are both tenant or trust. Any idea where I might be going wrong?

Thanks.

[livehybrid · Accepted solution]

Hi @dsgoody 

Firstly, the force_local_processing is only needed if you're running a Universal Forwarder. If its a Heavy Forwarder then you can safely remove this.

I think the main issue here is the stanza name - If you're referencing based on source then you need to use something like:

# props.conf
[source::UDP:<port>]

Alternatively you can apply the transforms based on the sourcetype:

# props.conf
[juniper]

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[dsgoody]

That is working perfectly, thank you.