Getting Data In

Using And condition between two different SOURCE_KEY in a stanza inside transforms.conf or in props.conf

jorcabro
Explorer

Hi,

I want to filter out Checkpoint events based on two different conditions:

  1. It comes from a specific IP XX.XX.XX.XX, I have this information in host metadata field.
  2. The action field after parsing the _raw can't be equal to allowed.

I can filter out these two conditions separately with stanzas like this:

[parse-action]
REGEX = action=accept
DEST_KEY = queue
FORMAT = nullQueue

[parse-hosts]
SOURCE_KEY = MetaData:Host
REGEX = (xx.xx.xx.xx|yy.yy.yy.yy)
DEST_KEY = queue
FORMAT = nullQueue

But I need that both of them are true at the same time, so I need to do an and between them.

How could I acomplish this?

Ps. I don't have the host info anywhere in the _raw data, so I can't use the same regex

Edit: Another approach will be to add the and condition in props.conf. This is the configuration right now:

TRANSFORMS-checkpoint_events = parse-action, parse-hosts

Instead of telling it to apply this after this, I want to apply this AND this

0 Karma

rupesh26
Path Finder

what's the difference ? the below works for you isn't ?
TRANSFORMS-checkpoint_events = parse-action, parse-hosts

0 Karma

jorcabro
Explorer

But that applies both of the transforms no matter what.
I only want to apply the tranforms if, and only if, both of the conditions are true. That means traffic from host xxxx AND accepted not traffic from host xxxx OR traffic accepted.

0 Karma

rupesh26
Path Finder

Think its tricky, as per the configurations the transforms are applied in order. So in any case both conditions would apply. So I don't think its achievable. You can raise a case to Splunk and see if there is a solution for this.

Meanwhile if you can add the host as well to the _raw events that is also a workaround.

Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...