Getting Data In

Using And condition between two different SOURCE_KEY in a stanza inside transforms.conf or in props.conf

jorcabro
Explorer

Hi,

I want to filter out Checkpoint events based on two different conditions:

  1. It comes from a specific IP XX.XX.XX.XX, I have this information in host metadata field.
  2. The action field after parsing the _raw can't be equal to allowed.

I can filter out these two conditions separately with stanzas like this:

[parse-action]
REGEX = action=accept
DEST_KEY = queue
FORMAT = nullQueue

[parse-hosts]
SOURCE_KEY = MetaData:Host
REGEX = (xx.xx.xx.xx|yy.yy.yy.yy)
DEST_KEY = queue
FORMAT = nullQueue

But I need that both of them are true at the same time, so I need to do an and between them.

How could I acomplish this?

Ps. I don't have the host info anywhere in the _raw data, so I can't use the same regex

Edit: Another approach will be to add the and condition in props.conf. This is the configuration right now:

TRANSFORMS-checkpoint_events = parse-action, parse-hosts

Instead of telling it to apply this after this, I want to apply this AND this

0 Karma

rupesh26
Path Finder

what's the difference ? the below works for you isn't ?
TRANSFORMS-checkpoint_events = parse-action, parse-hosts

0 Karma

jorcabro
Explorer

But that applies both of the transforms no matter what.
I only want to apply the tranforms if, and only if, both of the conditions are true. That means traffic from host xxxx AND accepted not traffic from host xxxx OR traffic accepted.

0 Karma

rupesh26
Path Finder

Think its tricky, as per the configurations the transforms are applied in order. So in any case both conditions would apply. So I don't think its achievable. You can raise a case to Splunk and see if there is a solution for this.

Meanwhile if you can add the host as well to the _raw events that is also a workaround.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...