How could i filter network firewall data using a filed value ?

[Afef]

Hello,

I have a firewall that sends a lot of data, i would like to filter events using a specific field value (exemple whitelist field="value")

my stanza is like this :

[udp://516]
connection_host = ip
sourcetype = stonegate
whitelist = deviceExternalId="value"

This didn't work and i still get all of data.

Any help please ?

thanks

[jmallorquin]

Hi Afef

The correct way is

In props.conf

[stonegate]
TRANSFORMS-erase = eventerase

in transforms.conf

[eventerase]
 REGEX=  deviceExternalId\=\"value\" <<--- the regular expresion that match the events that you want to filter
 DEST_KEY=queue
 FORMAT=nullQueue

Hope help you

[woodcock]

It won't work unless you remove the comment string ( <<--- the regular expresion that match the events that you want to filter ). That is probably all that is wrong; otherwise this solution should work.

[Afef]

This did not work for me !

i have events like this :

Dec 18 13:54:29 10.1.140.3 CEF:0|McAfee|Firewall|5.7.5|70018|Connection_Allowed|0|spt=31579 deviceExternalId=ExempleValue-FW node 1.....

I did the config on props.conf & transforms.conf but i still have data in

[jmallorquin]

Have you restart splunk after configure the props.conf and transforms.conf?

Can you add the content of the config files just to check the configuration?

And also, where the did you configure these files? indexer i hope

[Afef]

yes i restarted the splunk server (yes the indexer , i have one splunk isntance)

the config :

In props.conf

 [stonegate]
 TRANSFORMS-erase = eventerase

in transforms.conf

 [eventerase]
  REGEX=  deviceExternalId\=\"ExempleValue-FW\"
  DEST_KEY=queue
  FORMAT=nullQueue

[jmallorquin]

Hi,

I think the error is in the regex, please use this one

REGEX=  deviceExternalId\=ExempleValue\-FW

[Afef]

Thanks for your answer it works 🙂

If i would like to put many values :

REGEX= deviceExternalId=(ExempleValue-FW|ExempleValue2-FW) ?

[jmallorquin]

Yes,

But remember to escape the -

🙂

[Afef]

yes yes

REGEX= deviceExternalId=(ExempleValue-FW|ExempleValue2-FW)

Thank you 🙂

[jmallorquin]

And also remember to scape the second =

REGEX= deviceExternalId\=(ExempleValue\-FW|ExempleValue2\-FW) 

De nada

[javiergn]

If you want to filter data you have to play with the props and transforms files.
Take a look at this:

• http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad#Filter_event_data_...
• https://answers.splunk.com/answers/107605/filtering-events-out-via-props-conf-and-transforms-conf.ht...

Keep in mind this is not going to work on Universal Forwarders so make sure you are running it on a full enterprise installation.

Thanks,
J