Getting Data In

Filter events from UF based on source + sourcetype or host

realsplunk
Motivator

Hello,

is it possible to filter events based on sourcetype + (host OR sourcetype) with props.conf/transforms.conf on indexers?

Filtering data only based on sourcetype or source could be too wide.

Thanks.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @realsplunk,
to filter events you have to identify a large information (e.g. sourcetype or host or source), then you have to find a regex to filter logs related to the above information.
You cannot use two of the above infos (e.g. sourcetype+host)
E.g.: sourcetype=WinEventLog:Security and regex = EventCode=1234

in props.conf

[wineventlog:security]
TRANSFORMS-null= setnull

in transforms.conf

[setnull]
REGEX = EventCode\=1234
DEST_KEY = queue
FORMAT = nullQueue

For more infos see at https://docs.splunk.com/Documentation/Splunk/8.0.1/Forwarding/Routeandfilterdatad

Ciao.
Giuseppe

to4kawa
SplunkTrust
SplunkTrust
0 Karma

realsplunk
Motivator

Thanks, do you have an example based on a string?

0 Karma

to4kawa
SplunkTrust
SplunkTrust

No, I don't have. sorry.

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.