Splunk Enterprise Security
Highlighted

ESS SEP, Check Point and TippingPoint TA Filters

Communicator

Hi,

We're using the above and I was wondering if it is possible to filter out some unneeded event data to decrease index usage?

I've looked at the TA props and transforms quickly, it doesn't seem so obvious to me right now.

Thanks.

0 Karma
Highlighted

Re: ESS SEP, Check Point and TippingPoint TA Filters

Builder

ephemeric,

The ability to "null-queue" incoming data based on regular expression is native to Splunk. Since you have ESS in place you could put the props/transforms for your respective data sets in local directory of the TA. Keep in mind these are operations that are performed at index time, so those TA's should be pushed down to your indexers via deployment server.

## props.conf:
[tippingpoint]
TRANSFORMS-null_queue_for_tippingpoint = null_queue_for_tippingpoint

## transforms.conf:
[null_queue_for_tippingpoint]
REGEX = <your_regex_here>
DEST_KEY = queue
FORMAT = nullQueue

Here's some additional resources if needed:

http://answers.splunk.com/questions/11617/route-unwanted-logs-to-a-null-queue

http://www.splunk.com/base/Documentation/latest/Admin/Propsconf

http://www.splunk.com/base/Documentation/latest/Admin/Transformsconf

View solution in original post