Getting Data In

Specific DNS queries from Splunk Stream to nullQueue

b_chris21
Communicator

Hello everyone, 

I have tons of DNS queries in my enterprise on commercial legit domains (eg. partnerweb.vmware.com, login.live.com) which I don't want to log with Splunk Stream. My configuration is as follows but apparently it doesn't work:

app: Splunk_TA_stream_wire_data

props.conf

[streamfwd://streamfwd]
TRANSFORMS-blacklist-vmwarecom = vmware.com

transforms.conf

[vmware.com]
REGEX=query\=partnerweb\.vmware\.com
DEST_KEY=queue
FORMAT=nullQueue


Any help would be appreciated.

Kind regards,

Chris

 

Labels (3)
0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...

Security Newsletter Updates | March 2023

 March 2023 | Check out the latest and greatestUnify Your Security Operations with Splunk Mission Control The ...