Getting Data In

Stop indexing particular logs

ed07net_YG
Explorer

Hi community ,

I am trying to filter out some undesired traffic from a particular index. I read about the option using props.conf and transforms.conf. 

The query matching the traffic that I don't want, looks like this: 

index=abc sourcetype=abc_traffic dest_ip=255.255.255.255

The index abc is located in the search App. 

So, I went to my Search Head -> opt/splunk/etc/apps/search/local and modified the props.conf with the following: 

[abc_traffic]
TRANSFORMS-null= broadcast-null

Then, I created a TRANSFORMS.conf file in the same directory with the following entry: 

[broadcast-null]
REGEX= dest_ip= 255.255.255.255
DEST_KEY= queue
FORMAT= nullQueue

Restarted splunk

I am not sure if I am doing something wrong, maybe I am using the wrong location or format, not sure, I don't have too much experience managing Splunk. 

Appreciated any help! 

Labels (2)
0 Karma
1 Solution

SinghK
Builder

no not exactly, if there is an addon that is used for that data like any TA that you are using this props and transforms will go into that TA.  

you need to check which addon it is and add the data there and it will definitely be on your heavy forwarder/indexer you need to make changes a both locations for this to take affect as explained above @richgalloway .

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Those setting go on the indexer(s) and/or heavy forwarder, whichever the data passes through first.  Also, they have no effect on data already indexed.  Only new events will be filtered.

---
If this reply helps you, Karma would be appreciated.

ed07net_YG
Explorer

Thanks for the idea. 

However, we are sending those logs to a syslogng and then to our indexers. 

So, I realized that I should have create the props.conf and transforms.conf in the opt/splunk/etc/system/local. However, same result, I am still getting the logs. 

I believe that I might be choosing the wrong directory? 

Thanks, 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Which app the file is in matters less then which server it's on.  The settings MUST be on the indexer rather than the search head.

---
If this reply helps you, Karma would be appreciated.
0 Karma

SinghK
Builder

no not exactly, if there is an addon that is used for that data like any TA that you are using this props and transforms will go into that TA.  

you need to check which addon it is and add the data there and it will definitely be on your heavy forwarder/indexer you need to make changes a both locations for this to take affect as explained above @richgalloway .

ed07net_YG
Explorer

Thanks that helped, 


At the end that was part of the issue and also that I was using the wrong sourcetype, looks like the Add-on was changing the sourcetype name.  The following post helped me as well. 

 

https://community.splunk.com/t5/Splunk-Search/Easiest-way-to-exclude-ingestion-of-events-for-a-speci...

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...