Getting Data In

How could i filter network firewall data using a filed value ?

Afef
Communicator

Hello,

I have a firewall that sends a lot of data, i would like to filter events using a specific field value (exemple whitelist field="value")

my stanza is like this :

[udp://516]
connection_host = ip
sourcetype = stonegate
whitelist = deviceExternalId="value"

This didn't work and i still get all of data.

Any help please ?

thanks

Tags (1)
0 Karma

jmallorquin
Builder

Hi Afef

The correct way is

In props.conf

[stonegate]
TRANSFORMS-erase = eventerase

in transforms.conf

[eventerase]
 REGEX=  deviceExternalId\=\"value\" <<--- the regular expresion that match the events that you want to filter
 DEST_KEY=queue
 FORMAT=nullQueue

Hope help you

woodcock
Esteemed Legend

It won't work unless you remove the comment string ( <<--- the regular expresion that match the events that you want to filter ). That is probably all that is wrong; otherwise this solution should work.

0 Karma

Afef
Communicator

This did not work for me !

i have events like this :

Dec 18 13:54:29 10.1.140.3 CEF:0|McAfee|Firewall|5.7.5|70018|Connection_Allowed|0|spt=31579 deviceExternalId=ExempleValue-FW node 1.....

I did the config on props.conf & transforms.conf but i still have data in

0 Karma

jmallorquin
Builder

Have you restart splunk after configure the props.conf and transforms.conf?

Can you add the content of the config files just to check the configuration?

And also, where the did you configure these files? indexer i hope

0 Karma

Afef
Communicator

yes i restarted the splunk server (yes the indexer , i have one splunk isntance)

the config :

In props.conf

 [stonegate]
 TRANSFORMS-erase = eventerase

in transforms.conf

 [eventerase]
  REGEX=  deviceExternalId\=\"ExempleValue-FW\"
  DEST_KEY=queue
  FORMAT=nullQueue
0 Karma

jmallorquin
Builder

Hi,

I think the error is in the regex, please use this one

REGEX=  deviceExternalId\=ExempleValue\-FW
0 Karma

Afef
Communicator

Thanks for your answer it works 🙂

If i would like to put many values :

REGEX= deviceExternalId=(ExempleValue-FW|ExempleValue2-FW) ?

0 Karma

jmallorquin
Builder

Yes,

But remember to escape the -

🙂

0 Karma

Afef
Communicator

yes yes

REGEX= deviceExternalId=(ExempleValue-FW|ExempleValue2-FW)

Thank you 🙂

0 Karma

jmallorquin
Builder

And also remember to scape the second =

REGEX= deviceExternalId\=(ExempleValue\-FW|ExempleValue2\-FW) 

De nada

0 Karma

javiergn
SplunkTrust
SplunkTrust

If you want to filter data you have to play with the props and transforms files.
Take a look at this:

Keep in mind this is not going to work on Universal Forwarders so make sure you are running it on a full enterprise installation.

Thanks,
J

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!