Getting Data In

How to filter out messages to nullQueue that contain stringA, but keep messages that contain both stringB and stringA?

Volto
Path Finder

Hi,

We are filtering messages from our Cisco ASA logs that contain Teardown and Buildup, but we recently wanted to include messages that include SYN Timeout.

The problem with the messages that contain the SYN Timeout also contain Teardown, which are getting filtered out by our transforms.conf file.

My question: Is there a way for us to filter out the messages that contain Teardown, but keep the messages that keep SYN Timeout even though they contain the Teardown string?

0 Karma
1 Solution

woodcock
Esteemed Legend

I do not know the format of your logs but let us suppose it is something like this:

timestamp blah blah SYN Timeout blah blah Teardown blah blah

Then you can use a negative lookahead like this in transforms.conf to throw away ones with SYN Timeout but not Teardown:

[setnull]
REGEX = SYN Timeout(?!.*Teardown)
DEST_KEY = queue
FORMAT = nullQueue

View solution in original post

0 Karma

woodcock
Esteemed Legend

I do not know the format of your logs but let us suppose it is something like this:

timestamp blah blah SYN Timeout blah blah Teardown blah blah

Then you can use a negative lookahead like this in transforms.conf to throw away ones with SYN Timeout but not Teardown:

[setnull]
REGEX = SYN Timeout(?!.*Teardown)
DEST_KEY = queue
FORMAT = nullQueue
0 Karma

Volto
Path Finder

The log format looks like this;

blah blah blah Teardown blah blah blah SYN Timeout

I ended up using a regex like this for matching those that contained Teardown, which we wanted to throw away, but keep that had SYN Timeout, which we wanted to keep.

\s+(Teardown(?!.*SYN\sTimeout))\s+

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...