Getting Data In

Using And condition between two different SOURCE_KEY in a stanza inside transforms.conf or in props.conf

jorcabro
Explorer

Hi,

I want to filter out Checkpoint events based on two different conditions:

  1. It comes from a specific IP XX.XX.XX.XX, I have this information in host metadata field.
  2. The action field after parsing the _raw can't be equal to allowed.

I can filter out these two conditions separately with stanzas like this:

[parse-action]
REGEX = action=accept
DEST_KEY = queue
FORMAT = nullQueue

[parse-hosts]
SOURCE_KEY = MetaData:Host
REGEX = (xx.xx.xx.xx|yy.yy.yy.yy)
DEST_KEY = queue
FORMAT = nullQueue

But I need that both of them are true at the same time, so I need to do an and between them.

How could I acomplish this?

Ps. I don't have the host info anywhere in the _raw data, so I can't use the same regex

Edit: Another approach will be to add the and condition in props.conf. This is the configuration right now:

TRANSFORMS-checkpoint_events = parse-action, parse-hosts

Instead of telling it to apply this after this, I want to apply this AND this

0 Karma

rupesh26
Path Finder

what's the difference ? the below works for you isn't ?
TRANSFORMS-checkpoint_events = parse-action, parse-hosts

0 Karma

jorcabro
Explorer

But that applies both of the transforms no matter what.
I only want to apply the tranforms if, and only if, both of the conditions are true. That means traffic from host xxxx AND accepted not traffic from host xxxx OR traffic accepted.

0 Karma

rupesh26
Path Finder

Think its tricky, as per the configurations the transforms are applied in order. So in any case both conditions would apply. So I don't think its achievable. You can raise a case to Splunk and see if there is a solution for this.

Meanwhile if you can add the host as well to the _raw events that is also a workaround.

Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...