Getting Data In

Null filtering not working with props and transforms


I have the following conf file configs to drop any event that contains the verbiage, "Allow all zones to query DNS anycast address", in Palo logs:

TRANSFORMS-paloanycast = paloruledrop
REGEX = Allow all zones to query DNS anycast address
DEST_KEY = queue
FORMAT = nullQueue

Snippet of event



Nov 20 07:11:00 firewall,2021/11/20 07:10:59,010701010006,TRAFFIC,end,2305,2021/11/20 07:10:59,x.x.x.x,y.y.y.y,,,Allow all zones to query DNS anycast address,,,dns,vsys7,vrf,xxx-xx-x,,,data-data-data,2021/11/20...



Applied the  changes to my cluster master and pushed to the indexers (verified the indexers got the config), but these "Allow all zones to query DNS anycast address" events are not being dropped.

I verified the regex on

Any help would be appreciated


Labels (1)
Tags (4)
0 Karma


Typically, PaloAlto logs aren’t ingested as pan:traffic directly, but rather as pan:log (or older as pan_log)

this gets changed into pan:traffic (and pan:other-log-types) during the transforms step assuming you have the Pan-TA:

So you likely need [pan:log] or [pan_log] in your props instead of [pan:traffic] depending on what your inputs look like on your forwarders

Secondly you mention this is on your indexers. Are your PAN logs being ingested by Universal Forwarders or Heavy Forwarders? If they are Heavy Forwarders, or you are sending through  intermediate Heavy Forwarders, then parsing is already complete by the time you reach your indexers, and your props and transforms need to be on a different system (the first HF in the path from your syslog servers to your indexers)

Hope this helps


Thx for the reply

I am using the Palo TA and ingesting the logs via HF with the sourcetype set to pan:traffic

0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out >> As our brave ...