Getting Data In

Setnull and Setparsing

rashi83
Path Finder

I am using SETNULL and SETPARSING to include and exclude log events. Here is the files -

Props.conf
[OktaIM2:log]
TRANSFORMS-set= setnull,setparsing

transforms.conf
[setnull]
REGEX=gmail.com
DEST_KEY=queue
FORMAT=nullQueue

[setparsing]
REGEX=yahoo.com
DEST_KEY=queue
FORMAT=indexQueue

SETNULL filter works well, but not SETPARSING one. I tried following -

1) changed order to setparsing,setnull in props.conf
restarted splunk after making changes

Any insights why INCLUDE filter is not working as expected ?

0 Karma

to4kawa
Ultra Champion
0 Karma

rashi83
Path Finder

@to4kawa - Exactly I did the same thing as well.

REGEX works fine in SETNULL but not in SETPARSING.
[setnull]
REGEX= .
DEST_KEY=queue
FORMAT=nullQueue

[setparsing]
REGEX=yahoo.com
DEST_KEY=queue
FORMAT=indexQueue

If I put REGEX of SETPARSING in SETNULL , it works well - which indicates its not a REGEX issue too.

Any other insight ?

0 Karma

DalJeanis
Legend

Okay, so you are creating a field called queue that contains either the value nullQueue, the value indexQueue, or no value at all.

First, if any part of the record matches the REGEX gmail.com (for instance gmailxcom and gmail.com match that regex) then the field will be assigned the value nullQueue.

Then, if any part of the record matches the REGEX yahoo.com (for instance yahoo9com and yahoo.com match that regex) then the field will be assigned or changed to the value indexQueue.

If no part matches either, then the field queue will not be created.

So, when you say it is not working, are you saying that events which have the value yahoo.com in them are not being assigned a value for queue?

And where and when are you validating that?

0 Karma
Get Updates on the Splunk Community!

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...

From Alert to Resolution: How Splunk Observability Helps SREs Navigate Critical ...

It's 3:17 AM, and your phone buzzes with an urgent alert. Wire transfer processing times have spiked, and ...