Getting Data In

Prevent events from ingesting

New Member


after connecting AWS add-on and configuration, 

I have this query which is filling my index with much unwanted events :

index=cloudtrail "userIdentity.sessionContext.sessionIssuer.userName"=PrismaCloudReadOnlyRole errorCode=success


how can I prevent this username from indexing ?

can I do it on the local .conf file ?


Labels (2)
Tags (2)
0 Karma

Re: Prevent events from ingesting


Your method to make this work depends on how regular the data is.  userIdentity.sessionContext.sessionIssuer.userName sure feels like it comes from JSON. If so, I'd recommend using a sed statement in props.conf on whatever server is first getting hold of parsing phase on the data.  For example, on prem either your index or heavy forwarder.  

For example, let's say
your data is pretty regular and looks like this AWS example:
"userIdentity": {
    "type": "IAMUser",
    "principalId": "AIDAJ45Q7YFFAREXAMPLE",
     "arn": "arn:aws:iam::123456789012:user/Alice",
    "accountId": "123456789012",
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "userName": "Alice" }

On the parsing phase you can add a props.conf that uses sed command to strip that username.
SEDCMD-strip_username = s/accountId":"(\d{12})/accountId":"\1/g

Take that example, and adjust if your data doesn't look like the example.

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.