Getting Data In

forward a subset of existing input

dhaffner
Path Finder

I’m trying to take a subset of our regular logs and forward them on to another department.
Am I doing this right? Is the RegEx correct? Do I have the right idea here?

So, what I need to do is forward ONLY the logs that have one of the following in them (this is 4 out of hundreds):

group\geo\country1\*
group\geo\country2\*
group\geo\country3\sub1\*
group\geo\country3\sub12\*

This field is already extracted in transforms.conf as “PathAndName”, but includes hundreds of others as well. (It’s the 3rd last field in the current transforms.conf below)

TRANSFORMS.CONF

Already existing extraction in transforms.conf

[test_extractions]
DELIMS = "|"
FIELDS = "EventID","AlertTime","ThreatInstanceID","ActionTaken","country2erName","Scountry1nnerType","ThreatName","Statcountry2","ThreatType","ThreatSubType","ComputerID","FullFilePath","FileNameOffset","Name","DNSName","IPAddress","OperatingSystem","ServicePack","Vircountry2DataVersion","FullFilePathCheckSum","ThreatLocountry1lID","CheckSum","SAVVersion","DomainName","PathAndName","ParentGroup","SophosDB"

Currently I have the following, but it isn’t working, even though it works great in Expresso and RegexBuddy (as well as about 20 other things!):

[test_to_SSIM]
REGEX= (?i)(?<PathAndName>group\\geo\\country2|group\\geo\\country1|group\\geo\\country3\\sub1|group\\geo\\country3\\sub12)
DEST_KEY=_TCP_ROUTING
FORMAT=test_to_SSIM

PROPS.CONF

[source::existing_feed]
TRANSFORMS-routing = test_to_SSIM

OUTPUTS.CONF

[tcpout:test_to_SSIM]
server=xxx.xxx.xxx.xxx:10595
sendCookedData=false
dropEventsOnQueueFull = 10
Tags (1)

dart
Splunk Employee
Splunk Employee

That all looks correct.

You may want to ensure you set to index and forward in outputs.conf

[default]
indexAndForward=true

See more examples at the splunk documentation

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...