Getting Data In

Prevent events from ingesting

ranmys
Loves-to-Learn

Hello,

after connecting AWS add-on and configuration, 

I have this query which is filling my index with much unwanted events :

index=cloudtrail "userIdentity.sessionContext.sessionIssuer.userName"=PrismaCloudReadOnlyRole errorCode=success

 

how can I prevent this username from indexing ?

can I do it on the local .conf file ?

Thanks

Labels (2)
Tags (2)
0 Karma

livehybrid
Builder

You could use props and transforms to filter out data that you dont want and drop into the nullQueue.

Something like this:

props.conf

 

[aws:cloudtrail]
TRANSFORMS-0 = ignorePrismaCloudRORole

 

transforms.conf

 

[ignorePrismaCloudRORole]
REGEX = userIdentity\"\:\s\{\"sessionContext\".+\"sessionIssuer[^\}]+\"userName\": \"ignorePrismaCloudReadOnlyRole\"[^}]+
DEST = queue
FORMAT = nullQueue

 

0 Karma

The_Simko
SplunkTrust
SplunkTrust

Your method to make this work depends on how regular the data is.  userIdentity.sessionContext.sessionIssuer.userName sure feels like it comes from JSON. If so, I'd recommend using a sed statement in props.conf on whatever server is first getting hold of parsing phase on the data.  For example, on prem either your index or heavy forwarder.  

For example, let's say
your data is pretty regular and looks like this AWS example:
"userIdentity": {
    "type": "IAMUser",
    "principalId": "AIDAJ45Q7YFFAREXAMPLE",
     "arn": "arn:aws:iam::123456789012:user/Alice",
    "accountId": "123456789012",
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "userName": "Alice" }

On the parsing phase you can add a props.conf that uses sed command to strip that username.
[sourcetype::<whatever>]
SEDCMD-strip_username = s/accountId":"(\d{12})/accountId":"\1/g

Take that example, and adjust if your data doesn't look like the example.


0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...