Getting Data In

Way to exclude ingestion of events for a specific IP address from a SourceType?

elvis5
Loves-to-Learn Lots

When I try use :

transforms.conf

[setnull]
 REGEX = 192\.168\.1\.50, 172\.16\.1\.50
 DEST_KEY = queue
 FORMAT = nullQueue

 props.conf

 [cisco]
 TRANSFORMS-null = setnull

 In event I get all result. But when I use  only one ip its woks good. If any way for exclude more than one ip. 

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @elvis5,

it's a regex, you have to use pipe ("|") as OR condition, not comma separated values:

[setnull]
 REGEX = (192\.168\.1\.50)|(172\.16\.1\.50)
 DEST_KEY = queue
 FORMAT = nullQueue
 props.conf

Ciao.

Giuseppe

0 Karma

elvis5
Loves-to-Learn Lots

Thanks it works!

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @elvis5,

if one answer solves your need, please accept one answer for the other people of Community or tell me how I can help you.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

🍂 Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...