Splunk Enterprise Security

ESS SEP, Check Point and TippingPoint TA Filters

ephemeric
Contributor

Hi,

We're using the above and I was wondering if it is possible to filter out some unneeded event data to decrease index usage?

I've looked at the TA props and transforms quickly, it doesn't seem so obvious to me right now.

Thanks.

0 Karma
1 Solution

hazekamp
Builder

ephemeric,

The ability to "null-queue" incoming data based on regular expression is native to Splunk. Since you have ESS in place you could put the props/transforms for your respective data sets in local directory of the TA. Keep in mind these are operations that are performed at index time, so those TA's should be pushed down to your indexers via deployment server.

## props.conf:
[tippingpoint]
TRANSFORMS-null_queue_for_tippingpoint = null_queue_for_tippingpoint

## transforms.conf:
[null_queue_for_tippingpoint]
REGEX = <your_regex_here>
DEST_KEY = queue
FORMAT = nullQueue

Here's some additional resources if needed:

http://answers.splunk.com/questions/11617/route-unwanted-logs-to-a-null-queue

http://www.splunk.com/base/Documentation/latest/Admin/Propsconf

http://www.splunk.com/base/Documentation/latest/Admin/Transformsconf

View solution in original post

hazekamp
Builder

ephemeric,

The ability to "null-queue" incoming data based on regular expression is native to Splunk. Since you have ESS in place you could put the props/transforms for your respective data sets in local directory of the TA. Keep in mind these are operations that are performed at index time, so those TA's should be pushed down to your indexers via deployment server.

## props.conf:
[tippingpoint]
TRANSFORMS-null_queue_for_tippingpoint = null_queue_for_tippingpoint

## transforms.conf:
[null_queue_for_tippingpoint]
REGEX = <your_regex_here>
DEST_KEY = queue
FORMAT = nullQueue

Here's some additional resources if needed:

http://answers.splunk.com/questions/11617/route-unwanted-logs-to-a-null-queue

http://www.splunk.com/base/Documentation/latest/Admin/Propsconf

http://www.splunk.com/base/Documentation/latest/Admin/Transformsconf

Get Updates on the Splunk Community!

Exciting News: The AppDynamics Community Joins Splunk!

Hello Splunkers,   I’d like to introduce myself—I’m Ryan, the former AppDynamics Community Manager, and I’m ...

The All New Performance Insights for Splunk

Splunk gives you amazing tools to analyze system data and make business-critical decisions, react to issues, ...

Good Sourcetype Naming

When it comes to getting data in, one of the earliest decisions made is what to use as a sourcetype. Often, ...