Splunk Cloud Platform

How to exclude events with specific rule in PAN Traffic?

New Member

In PAN tarffic, where we are trying to exclude events with "block-untst-rule" string. PAN traffic logs are configured to receive in syslog server. I tried to use filter in syslog-ng config as shown below. 

filter exclogs { not match("block\\-untst\\-rule"); };

log {source(s_syslog_pa_cloud); filter {exclogs}; destination(d_syslog_pa_cloud); };

Other way we tried is by using props.conf and transforms.conf

TRANSFORMS-set = setnull

REGEX = block\\-untst\\-rule
DEST_KEY = queue
FORMAT = nullQueue

Both ways we are not able to exclude the events from ingesting. Please do assist.

Labels (1)
0 Karma


The escape characters in the regular expressions are not necessary.  Using double escape characters tells Splunk to expect a backslash in the data, which probably is not the case.

REGEX = block-untst-rule
DEST_KEY = queue
FORMAT = nullQueue
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...