Getting Data In

How to filter out any Meraki access point messages from being indexed in Splunk?

CrownIT
New Member

Hello everyone. I am new to SPlunk and syslog in general, but have gotten pretty far in the past week. I've got a Barracuda web filter and a Meraki MX90 sending data to Splunk with many reports and search built, so much that it has eliminated my need for the Barracuda admin panel.

My only problem is the Meraki MX90 sends two log entries for every URL accessed. This is because our wireless AP's are on the same system as the MX90, so I get two entries for every URL access as shown here:

Oct 23 08:58:13 xxx.xxx.xxx.xxx 1 1414069093.265104392 TBC_MX90 urls src=10.9.21.180:54043 dst=23.66.230.128:80 mac=xx:xx:xx:xx:xx:xx request: GET http://photos-b.ak.instagram.com/hphotos-ak-xaf1/10731741_xyz049522392569_653661020_n.jpg

Oct 23 08:58:13 xxx.xxx.xxx.xxx 1 0.0 Dorm_21_East_Repeater urls src=10.9.21.180:54043 dst=23.66.230.128:80 mac=xx:xx:xx:xx:xx:xx request: GET http://photos-b.ak.instagram.com/hphotos-ak-xaf1/10731741_xyz049522392569_653661020_n.jpg

We've got a ton of syslog data coming in, and there is absolutely no reason to keep the data from the access points in our database. Because I don't know exactly how to modify the various files, can someone please walk a dummy through preventing any message from my Meraki AP's from being indexed?

I figured the common phrase to look for in the raw event data to filter out ALL the AP's be "0.0 Dorm" since all the AP's are named similarly. Dorm_21_East_Repeater, Dorm_22_West_Gateway, Dorm_17_North_Repeater, etc...

This is the last hurdle I have with using Splunk effectively right now. It's been seven days, and four days I've reached the free trial license limits, and it's because of the extreme amount of data duplication. I've no doubt I will push to purchase a license, but our server space is at a premium. Thanks so much in advance for any help.

Rob Novak
The Crown College
Powell, TN

0 Karma

richard_g_curry
Explorer

This is rather old, have you got it figured out? If not ...

For your sourcetype, try this:

props.conf
[your_sourcetype]
TRANSFORMS-filter_dorm = filter_dorm

transforms.conf
[filter_dorm]
REGEX = 0.0\s+Dorm
DEST_KEY = queue
FORMAT = nullQueue

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...