Splunk Search

Drop some json fields according to their values

sigma
Path Finder

Hi all,

I have a forwarder in my cluster and it sends events to the indexers. The events are json formatted and I want to drop some events if a specific key has specific value. For example consider following event:

 

{"process_exec":{"process":{"exec_id":"xXXXXXXXXXx==","pid":1111111,"cwd":"/tmp","binary":"/bin/sleep","arguments":"10"}}}

 

I want to for example if the binary was equal to X, the forwarder drops the event and not send to indexers no index.

I created props.conf and transforms.conf. The content of these files are:

 

[json_no_timestamp]
TRANSFORMS-filter = filterLinux

 

and

 

[filterLinux]
REGEX = process.process_exec.binary = '/usr/bin/timeout'
DEST_KEY=queue
FORMAT=nullQueue

 

But the events are not dropped.

Any help is appreciated.

Labels (3)
Tags (2)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

Unfortunately Splunk cannot process JSON at that level.  Also, the value in your REGEX property doesn't make good regex.  How rigid are the format of these events?  If it is rigid enough, you can use something as simple as

REGEX = \"bindary\":\"/usr/bin/timeout\"

If you have multiple subnodes with key name "binary" and value run-in, you can build better regex based on these possibilities, all provided that format is very rigid.

Granted, JSON format can change without altering semantics.  So, this is not going to be very robust.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...