Splunk Cloud Platform

How to exclude events with specific rule in PAN Traffic?

New Member

In PAN tarffic, where we are trying to exclude events with "block-untst-rule" string. PAN traffic logs are configured to receive in syslog server. I tried to use filter in syslog-ng config as shown below. 

filter exclogs { not match("block\\-untst\\-rule"); };

log {source(s_syslog_pa_cloud); filter {exclogs}; destination(d_syslog_pa_cloud); };

Other way we tried is by using props.conf and transforms.conf

TRANSFORMS-set = setnull

REGEX = block\\-untst\\-rule
DEST_KEY = queue
FORMAT = nullQueue

Both ways we are not able to exclude the events from ingesting. Please do assist.

Labels (1)
0 Karma


The escape characters in the regular expressions are not necessary.  Using double escape characters tells Splunk to expect a backslash in the data, which probably is not the case.

REGEX = block-untst-rule
DEST_KEY = queue
FORMAT = nullQueue
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...