Getting Data In

Excluding events from Juniper SRX logs

dsgoody
Engager

Hi all,

I'm having some issues excluding events from our Juniper SRX logs. These events are ingested directly on our Windows Splunk Heavy Forwarders, since these two firewalls are the only syslog inputs we have. My current config is as follows;

inputs.conf
[udp://firewallip:port]
connection_host = ip
disabled = false
index = juniper
sourcetype = juniper

props.conf
[udp://firewallip:port]
TRANSFORMS-null=TenantToTrust,TrustToTenant
force_local_processing = true

transforms.conf
[TenantToTrust]
REGEX = source-zone-name="tenant".*destination-zone-name="trust"
DEST_KEY = queue
FORMAT = nullQueue

[TrustToTenant]
REGEX = source-zone-name="trust".*destination-zone-name="tenant"
DEST_KEY = queue
FORMAT = nullQueue

All we'd like to do is exclude any events where the source and destination zones are both tenant or trust. Any idea where I might be going wrong?

Thanks.

0 Karma
1 Solution

livehybrid
Ultra Champion

Hi @dsgoody 

Firstly, the force_local_processing is only needed if you're running a Universal Forwarder. If its a Heavy Forwarder then you can safely remove this.

I think the main issue here is the stanza name - If you're referencing based on source then you need to use something like:

# props.conf
[source::UDP:<port>]

Alternatively you can apply the transforms based on the sourcetype:

# props.conf
[juniper]

:glowing_star: Did this answer help you? If so, please consider:

  • Adding karma to show it was useful
  • Marking it as the solution if it resolved your issue
  • Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

View solution in original post

0 Karma

livehybrid
Ultra Champion

Hi @dsgoody 

Firstly, the force_local_processing is only needed if you're running a Universal Forwarder. If its a Heavy Forwarder then you can safely remove this.

I think the main issue here is the stanza name - If you're referencing based on source then you need to use something like:

# props.conf
[source::UDP:<port>]

Alternatively you can apply the transforms based on the sourcetype:

# props.conf
[juniper]

:glowing_star: Did this answer help you? If so, please consider:

  • Adding karma to show it was useful
  • Marking it as the solution if it resolved your issue
  • Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

0 Karma

dsgoody
Engager

That is working perfectly, thank you.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...