Getting Data In

How to filter out certain events from checkpoint data?

rodrigorsilva
Communicator

Hi everyone,

I need help to create a better regex in my transforms.conf. I am filtering checkpoint data in my Splunk.

In this case, I don't want collect the following event policy_name=firewall_name

I created the props.conf and transforms.conf:

 props.conf:
 [script:///splunk/splunk/etc/apps/Splunk_TA_opseclea_linux22/bin/lea-loggrabber.sh --configentity SplunkLEA]
 TRANSFORMS-null = eliminate_opsec

 transforms.conf
 [eliminate-opsec]
 REGEX = policy_name\=firewall_name
 DEST_KEY = queue
 FORMAT = nullQueue

How do I do add this function ?

0 Karma
1 Solution

rodrigorsilva
Communicator

Hello everyone

We had successfully with the informed documentation, see below how the files were edited:

http://docs.splunk.com/Documentation/Splunk/6.2.3/Forwarding/Routeandfilterdatad
https://answers.splunk.com/answers/99636/need-help-with-nullqueue-specifics-included.html

  • props.conf
    [opsec]
    TRANSFORMS-null = setnullopsec

  • transforms.conf
    [setnullopsec]
    REGEX = policy_name=(FIrewall_1|Firewall_2)
    DEST_KEY = queue
    FORMAT = nullQueue

Thank you very much.

Rodrigo Ribeiro

View solution in original post

0 Karma

rodrigorsilva
Communicator

Hello everyone

We had successfully with the informed documentation, see below how the files were edited:

http://docs.splunk.com/Documentation/Splunk/6.2.3/Forwarding/Routeandfilterdatad
https://answers.splunk.com/answers/99636/need-help-with-nullqueue-specifics-included.html

  • props.conf
    [opsec]
    TRANSFORMS-null = setnullopsec

  • transforms.conf
    [setnullopsec]
    REGEX = policy_name=(FIrewall_1|Firewall_2)
    DEST_KEY = queue
    FORMAT = nullQueue

Thank you very much.

Rodrigo Ribeiro

0 Karma

rodrigorsilva
Communicator

Sorry, corrected.

See image:

alt text

I tried including the props.conf otherwise specified, but could not figure out if my props file or transforms is incorrect or even both.

0 Karma

jmallorquin
Builder

Hi,

Reviewing your configuration there is a mistake about the name of the transform.

eliminate_opsec vs eliminate-opsec

They have to be the same.

Hope i help you.

0 Karma

jmallorquin
Builder

Hi,

Have you restarted splunk daemon?

Hope help you

0 Karma

rodrigorsilva
Communicator

HI,

Yes, i tried this, but not worked.

Rodrigo Ribeiro

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...