Getting Data In

Null Filtering Not Working

iamDT03
Engager

Greetings all. I am having some trouble getting syslog data to filter with regards to nullQueue. Below are what my config files look like and some additional troubleshooting I've taken so far.

inputs.conf

[udp://5514]
connection_host = ip
index = org_index
sourcetype = cisco:firepower:syslog

 

props.conf

[source::udp:5514]
TRANSFORMS-set= setnull,setparsing

 

transforms.conf

[setnull]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue

[setparsing]
REGEX = \%FTD-\d-(430002|430003)
DEST_KEY = queue
FORMAT = indexQueue

 

My environment flows Firepower syslog > Heavy Fwd (on prem) > Splunk Cloud and the above configs are on the Heavy Fwd.

In the syslog stream, there are "Correlation Event" logs I am trying to drop. Above I am trying to ingest only message ID's of 430002 and 430003 and drop everything else, however, Correlation Events are still coming in. I've also tried the alternative where I'm targeting Correlation Event in the regex in an effort to drop them, also unsuccessful. Below are some additional troubleshooting steps I've taken.

  • reformatting the source as [source::udp://5514] in props.conf
  • removed spaces before and after the equals signs for each attribute
  • removed the line "REGEX = ." in transforms.conf
  • tried the sourcetype in props.conf, so [cisco:firepower:syslog]
  • tried different regex matches, using regex101
  • restarting Heavy Fwd after each change

Here is the Splunk Doc I've been working with primarily: https://docs.splunk.com/Documentation/Splunk/8.1.0/Forwarding/Routeandfilterdatad#Discard_specific_e...

Any help is greatly appreciated!

Labels (4)
0 Karma
1 Solution

iamDT03
Engager

This issue has been resolved. The [setnull] transform stanza name was conflicting with another transform stanza from a separate add-on. Making the following changes to props.conf and transforms.conf remedied the problem.

#props.conf
[source::udp:5514]
TRANSFORMS-set= dropEvents,setparsing

#transforms.conf
[dropEvents]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue

[setparsing]
REGEX = \%FTD-\d(430002|430003)
DEST_KEY = queue
FORMAT = indexQueue

View solution in original post

0 Karma

iamDT03
Engager

This issue has been resolved. The [setnull] transform stanza name was conflicting with another transform stanza from a separate add-on. Making the following changes to props.conf and transforms.conf remedied the problem.

#props.conf
[source::udp:5514]
TRANSFORMS-set= dropEvents,setparsing

#transforms.conf
[dropEvents]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue

[setparsing]
REGEX = \%FTD-\d(430002|430003)
DEST_KEY = queue
FORMAT = indexQueue
0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...