I want to filter out Checkpoint events based on two different conditions:
I can filter out these two conditions separately with stanzas like this:
[parse-action] REGEX = action=accept DEST_KEY = queue FORMAT = nullQueue [parse-hosts] SOURCE_KEY = MetaData:Host REGEX = (xx.xx.xx.xx|yy.yy.yy.yy) DEST_KEY = queue FORMAT = nullQueue
But I need that both of them are true at the same time, so I need to do an and between them.
How could I acomplish this?
Ps. I don't have the host info anywhere in the _raw data, so I can't use the same regex
Edit: Another approach will be to add the and condition in props.conf. This is the configuration right now:
TRANSFORMS-checkpoint_events = parse-action, parse-hosts
Instead of telling it to apply this after this, I want to apply this AND this
But that applies both of the transforms no matter what.
I only want to apply the tranforms if, and only if, both of the conditions are true. That means traffic from host xxxx AND accepted not traffic from host xxxx OR traffic accepted.
Think its tricky, as per the configurations the transforms are applied in order. So in any case both conditions would apply. So I don't think its achievable. You can raise a case to Splunk and see if there is a solution for this.
Meanwhile if you can add the host as well to the _raw events that is also a workaround.