[host::192.168.1.20:514] TRANSFORMS-set= setnull,sra
[setnull] REGEX = . DEST_KEY = queue FORMAT = nullQueue [sra] REGEX = m=236 DEST_KEY = queue FORMAT = indexQueue
Basically, I want my Splunk server to accept any event where field "m" equals 236 for a certain host. All other events get discarded. After putting both in "Splunk\etc\system\local" and restarting Splunk, I'm still getting all events.
Here's an example of _raw:
Jan 20 14:49:37 10.11.83.1 id=firewall sn=123456789ABC time="2015-04-17 19:48:01 UTC" fw=192.168.1.96 pri=6 c=16 m=236 msg="An error has occurred" sess="Web" n=11 usr="admin" src=192.168.1.200 dst=192.168.1.95 proto=tcp/800
The REGEX attribute, during index-time operations, only works fields specified here, and by default applied to _raw. It doesn't apply to any custom field that you might have. If the literal string
m=235 is not there in raw data, it won't be effective. You need to write a REGEX which will work on your raw data to filter/drop events that you want. If you can provide some sample events, of both you want to keep and drop, and highlight where the field
m value is in there, we may suggest something.
You're saying because fields haven't been extracted at this point, yeah? The literal string, m=235, is in there.
The REGEX should match exact format where that literal string is available, check if there are any extra spaces in between. Also, this should be setup on Indexers/Heavy forwarder.
The thing is, I'd expect to be getting no information. But I'm still getting all. Is my props file correct?
Is that the exact host name? If all the data that you're receiving is for single sourcetype, use that (is much simpler). Also, How are you getting the data, through Universal forwarder? If yes, then is UF sending data to Indexers or some heavy forwarder? The props/transforms should be placed there. Other than that (location of conf files and validity of stanza name in props.conf), your configurations looks good.
I'm getting data from a network device via syslog. I cannot configure what it sends me. It's all or nothing.