Getting Data In

How to filter out any Meraki access point messages from being indexed in Splunk?

CrownIT
New Member

Hello everyone. I am new to SPlunk and syslog in general, but have gotten pretty far in the past week. I've got a Barracuda web filter and a Meraki MX90 sending data to Splunk with many reports and search built, so much that it has eliminated my need for the Barracuda admin panel.

My only problem is the Meraki MX90 sends two log entries for every URL accessed. This is because our wireless AP's are on the same system as the MX90, so I get two entries for every URL access as shown here:

Oct 23 08:58:13 xxx.xxx.xxx.xxx 1 1414069093.265104392 TBC_MX90 urls src=10.9.21.180:54043 dst=23.66.230.128:80 mac=xx:xx:xx:xx:xx:xx request: GET http://photos-b.ak.instagram.com/hphotos-ak-xaf1/10731741_xyz049522392569_653661020_n.jpg

Oct 23 08:58:13 xxx.xxx.xxx.xxx 1 0.0 Dorm_21_East_Repeater urls src=10.9.21.180:54043 dst=23.66.230.128:80 mac=xx:xx:xx:xx:xx:xx request: GET http://photos-b.ak.instagram.com/hphotos-ak-xaf1/10731741_xyz049522392569_653661020_n.jpg

We've got a ton of syslog data coming in, and there is absolutely no reason to keep the data from the access points in our database. Because I don't know exactly how to modify the various files, can someone please walk a dummy through preventing any message from my Meraki AP's from being indexed?

I figured the common phrase to look for in the raw event data to filter out ALL the AP's be "0.0 Dorm" since all the AP's are named similarly. Dorm_21_East_Repeater, Dorm_22_West_Gateway, Dorm_17_North_Repeater, etc...

This is the last hurdle I have with using Splunk effectively right now. It's been seven days, and four days I've reached the free trial license limits, and it's because of the extreme amount of data duplication. I've no doubt I will push to purchase a license, but our server space is at a premium. Thanks so much in advance for any help.

Rob Novak
The Crown College
Powell, TN

0 Karma

richard_g_curry
Explorer

This is rather old, have you got it figured out? If not ...

For your sourcetype, try this:

props.conf
[your_sourcetype]
TRANSFORMS-filter_dorm = filter_dorm

transforms.conf
[filter_dorm]
REGEX = 0.0\s+Dorm
DEST_KEY = queue
FORMAT = nullQueue

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...