Getting Data In

Problem filtering with props.conf and transform.conf

o_calmels
Communicator

Hi,

I parsed a lot of post on splunk answers, but I still have a problem to filter a specific sourcetype.

Here the log line I want to trash
Sep 11 16:16:08 192.168.24.35 ROOT_FW_2: NetScreen device_id=ROOT_FW_2 [Root]system-notification-00257(traffic): start_time="2017-09-11 16:15:51" duration=16 policy_id=86 service=smtp (tcp) proto=6 src zone=zone_in dst zone=zone_out action=Permit sent=22056 rcvd=1284 src=192.168.1.1 dst=192.168.10.10 src_port=40049 dst_port=80 src-xlated ip=192.168.100.5 port=40049 dst-xlated ip=10.25.23.55 port=80 session_id=1015055 reason=Close - TCP FIN

On my Formwarder:
$SPLUNK_HOME/etc/system/local/props.conf
# Filtrage de tout sauf les accept
[JuniperFW]
TRANSFORMS-Juniper-null = remove_juniper_permit

$SPLUNK_HOME/etc/system/local/transform.conf
# Accepter tout sauf les Permit
[remove_juniper_permit]
REGEX = action=Permit
DEST_KEY = queue
FORMAT = nullQueue

Splunkd was restarted with no stanza errors
My Splunk version is 6.6.3.

Does anyone should have de clue or a way to debug this ?

Thank's a lot.

0 Karma
1 Solution

o_calmels
Communicator

Hi woodcock, cusello,

Thank's for your response, all the lines are not joined in one line.
After trying your solutions, i contact splunk support team and the error is simply on the filename ! 😞

Yes, I forgive the "s" at the and of transforms.conf

Everything OK now !

Olivier

View solution in original post

0 Karma

o_calmels
Communicator

Hi woodcock, cusello,

Thank's for your response, all the lines are not joined in one line.
After trying your solutions, i contact splunk support team and the error is simply on the filename ! 😞

Yes, I forgive the "s" at the and of transforms.conf

Everything OK now !

Olivier

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi o.calmels,
in regex you have to insert a backslash before equal (=) because it's a special char.
try something like this:
in props.conf

[JuniperFW] 
TRANSFORMS-Juniper-null = remove_juniper_permit

in transforms.conf

[remove_juniper_permit] 
REGEX = action\=Permit 
DEST_KEY = queue 
FORMAT = nullQueue

Bye.
Giuseppe

0 Karma

woodcock
Esteemed Legend

Are those really joined on one line? If so, then you have no active configurations. It should be like this:

$SPLUNK_HOME/etc/system/local/props.conf

# Filtrage de tout sauf les accept
[JuniperFW]
TRANSFORMS-remove_juniper_permit = remove_juniper_permit

$SPLUNK_HOME/etc/system/local/transform.conf

# Accepter tout sauf les Permit
[remove_juniper_permit]
REGEX = action=Permit
DEST_KEY = queue
FORMAT = nullQueue

But the real problem is that this needs to be deployed to your Indexers (not forwarder) and all Splunk instances there need to be restarted. Then check the newly forwarded/indexed events (old Permits will still be there). This all assumes that the events have sourcetype of JuniperFW.

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!