Getting Data In

How to configure props.conf and transforms.conf to select events containing a string of words?

dseabury
Explorer

I have scoured the 'Net, Splunk docs and the Answers and found lots of good information on setting up my indexer filtering to reduce the noise coming from my firewall syslog UDP feed. I feel like I'm really close, because now there is nothing coming through. What I WANT to see are only messages that contain "TCP access denied". I can apply a piped REGEX statement on the search and it works, but I don't seem to have props and transforms files set up quite right yet.

This works in search: source=firewall | regex _raw="TCP access denied"

Props.conf:
[source::firewall]
TRANSFORMS-set= setnull,setparsing

Transforms.conf:
[setnull]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue

[setparsing]
REGEX _raw="TCP access denied"
DEST_KEY = queue
FORMAT = indexQueue

Any additional insight would be welcome!

1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Replace this:

REGEX _raw="TCP access denied"

With this:

REGEX = TCP access denied

That's assuming the quotes aren't part of the to-be-matched event.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Try reversing the order of your TRANSFORMS-set statement. The setnull transform is matching everything, leaving nothing for setparsing to index.

---
If this reply helps you, Karma would be appreciated.
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

The order setnull,setparsing is correct. Both are run, nullQueue is always set and sometimes overwritten by indexQueue.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Replace this:

REGEX _raw="TCP access denied"

With this:

REGEX = TCP access denied

That's assuming the quotes aren't part of the to-be-matched event.

martin_mueller
SplunkTrust
SplunkTrust

As a rule of thumb, restarting is necessary for all index-time configuration file changes, which this very much is.

Search-time config file changes may get along with a debug/refresh call.

dseabury
Explorer

SUCCESS!!! Thanks for the responses. I made the change recommended by martin_mueller and restarted Splunk (is that necessary?).

This will throw open the door for me to add more filtering and get our firewall index fully tuned...

Get Updates on the Splunk Community!

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...