Null filtering not working with props and transforms

[jwalzerpitt]

I have the following conf file configs to drop any event that contains the verbiage, "Allow all zones to query DNS anycast address", in Palo logs:

props.conf
[pan:traffic]
TRANSFORMS-paloanycast = paloruledrop
 
transforms.conf
[paloruledrop]
REGEX = Allow all zones to query DNS anycast address
DEST_KEY = queue
FORMAT = nullQueue

Snippet of event

Nov 20 07:11:00 firewall,2021/11/20 07:10:59,010701010006,TRAFFIC,end,2305,2021/11/20 07:10:59,x.x.x.x,y.y.y.y,0.0.0.0,0.0.0.0,Allow all zones to query DNS anycast address,,,dns,vsys7,vrf,xxx-xx-x,xxx.xxx,xxx.xxx,data-data-data,2021/11/20...

Applied the  changes to my cluster master and pushed to the indexers (verified the indexers got the config), but these "Allow all zones to query DNS anycast address" events are not being dropped.

I verified the regex on regex101.com

Any help would be appreciated

Thx

[acharlieh]

Typically, PaloAlto logs aren’t ingested as pan:traffic directly, but rather as pan:log (or older as pan_log)

this gets changed into pan:traffic (and pan:other-log-types) during the transforms step assuming you have the Pan-TA: https://github.com/PaloAltoNetworks/Splunk-Apps/blob/develop/Splunk_TA_paloalto/default/props.conf

So you likely need [pan:log] or [pan_log] in your props instead of [pan:traffic] depending on what your inputs look like on your forwarders

Secondly you mention this is on your indexers. Are your PAN logs being ingested by Universal Forwarders or Heavy Forwarders? If they are Heavy Forwarders, or you are sending through  intermediate Heavy Forwarders, then parsing is already complete by the time you reach your indexers, and your props and transforms need to be on a different system (the first HF in the path from your syslog servers to your indexers)

Hope this helps

[jwalzerpitt]

Thx for the reply

I am using the Palo TA and ingesting the logs via HF with the sourcetype set to pan:traffic