How to filter the data and route the logs from particular sourcetye based on certain keyword

[pankajupadhyay]

Please help me out.

I want to route below specific keyword logs to destination on heavyforwarder.

"logged out"

"Rejected password for user"

"Cannot login"

"logged in as"

"Accepted user for user"

"was updated on host"

"Password was changed for account"

"Destroy VM called" or destory

Can someone please help on this ?

[richgalloway]

What have you tried so far?

[pankajupadhyay]

@richgalloway 

I have tried to use below regex in transforms.conf

REGEX=(logged out|Rejected password for user|Cannot login|logged in as)

We want to send this particular event.

can you please let me know where i am doing mistkake

[pankajupadhyay]

@richgalloway 

Is that correct regex ?

[richgalloway]

The regex is valid, but is not enough to determine the source of the problem.  Please share the entire transforms.conf stanza, the related props.conf stanzas, and any other settings you've made to route data.

[pankajupadhyay]

@richgalloway 

Transforms.conf
[logs_type1]
REGEX = (logged out|Rejected password for user|Cannot login|logged in as|Accepted user for user|was updated on host|Password was changed for account|Destroy VM called)
DEST_KEY = _TCP_ROUTING
FORMAT = esxireceivier

Props.conf

[vmw_logs]
TRANSFORMS-routing=logs_type1

I am seeing that its forwarding the logs other than these keywords to destination which it should not.

Can you please help me in that ?

[richgalloway]

This is getting into an area in which I have little experience.

Do you have a [tcpout:esxireceivier] stanza in outputs.conf?

I believe you also need a transform that tells Splunk what to do with events that don't match your regex.  See https://docs.splunk.com/Documentation/Splunk/8.1.0/Forwarding/Routeandfilterdatad#Filter_and_route_e...