Getting Data In

How to setup a filter to drop specific events on the heavy forwarder?

arlombar1
Explorer

Hello, I'm trying to setup a filter to drop specific events that contain an event name from AWS. I've read through the splunk docs and the process seems straight forward:

On the HF where I am getting my input for AWS logs I've made the updates to the props.conf and transforms.conf file like so:

props.conf

[aws]
TRANSFORMS-set_null = to_null

transforms.conf

[to_null]
REGEX = eventname
DEST_KEY = queue
FORMAT = nullQueue

I did not list my regex in this example as I don't feel this is the issue (I've verified the expression works outside of splunk against the raw events).

Is there something else I am missing here? As a pre-caution ive also added the above files to my indexers, but am still seeing the events in question.

0 Karma

woodcock
Esteemed Legend

You need to restart all Splunk instances on the nodes that run the first full instance of Splunk handling the data (your HFs). Old events will stay broken but new events will be correct.

0 Karma

somesoni2
Revered Legend

This configuration should be in first SplunkEnterprise instance that comes in your data flow, which I assume is your heavy forwarder. Did you restart Splunk on your HF after making this configuration change? Also, make sure the sourcetype name is correct.

0 Karma

arlombar1
Explorer

Looks to be working now, I must of forgot to restart splunkd on the HF. Do I need to have the same props/transforms on the indexers as well? Just trying to clean up where I can.

0 Karma

somesoni2
Revered Legend

No.. it's only required on the instance where events go through parsingQueue (which is HF in your case).

0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...