Getting Data In

Question on dropping certain syslog events

BrendanCO
Path Finder

Hi guys. I've got both Palo Alto and Fortinet logs coming in to my Splunk instances and have the appropriate apps set up for each. The thing I'd like to do is see if there are any chatty and mostly useless events I can have Splunk drop and not process before it is received and counted against my license. Palos are pretty good about how to trim in the FW itself but the Fortinet isn't quite as granular.

Is there something I can put an inputs.conf file (or another similar app conf file) that will tell it to just drop an incoming event if it contains X?

Labels (1)
Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @BrendanCO,

it isn't possible to filter data on inputs.conf, with the only exception of wineventlogs.

So, you have to analyze your logs and find a rule  (to transform in a regex) to exactly identify the logs to discard: e.g. if you found that the events in the sourcetype "your_sourcetype" containing the string "INFO" are to drop before indexing, you can create a rule in props.conf and transforms.conf like this:

props.conf

 

[your_sourcetype]
TRANSFORMS-drop_PA_events = drop_PA_events

 

 transforms.conf

 

[drop_PA_events]
REGEX = INFO
DEST_KEY = queue
FORMAT = nullQueue

 

Remember that these props.conf and transforms.conf must be on Indexers and (when present) on Heavy Forwarders.

You can find more infos at https://docs.splunk.com/Documentation/Splunk/8.1.0/Forwarding/Routeandfilterdatad#Filter_event_data_...

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...