Splunk Search

Filtering PaloAlto events

Gene
Path Finder

Dear Splunkers, can you please help with the following problem:

We use single instance and PaloAlto logs are sent through udp. We have a lot of noisy events which I want to send to nullQueue. I have created props.conf and transforms.conf files:
props:
[pan:threat]
TRANSFORMS_drop = discard_info

Transforms:
[discard_info]
REGEX = ,informational,
DEST_KEY = queue
FORMAT = nullQueue

short part of log, that contains "informational" which I want to filter:   ,business-and-economy,informational,client-to-server,6966642515657316810,

For now events are not filtered out and I have no clue how to make it working, will really appreciate your help!

Labels (1)
0 Karma
1 Solution

Gene
Path Finder

Yes, I did. I have fixed problem by changing REGEX:
[discard_info]
REGEX = ^.*(THREAT,url,).*(informational).*$
DEST_KEY = queue
FORMAT = nullQueue

And also I have found that sourcetype needs to be pan:logs because with pan:thread - it is not working.

For now have additional problem trying to filter also events of pan:traffic and after editing transforms.conf file with additional stanza  :
[discard_traffic]
REGEX = ^.*(TRAFFIC,end).*(informational).*$
DEST_KEY = queue
FORMAT = nullQueue

and adding in props.conf discard_traffic - everything stops working... So I'm trying to figure out why this is happening

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Did you restart Splunk after changing the .conf files?  Does the incoming data have the expected sourcetype (pan:threat)?

---
If this reply helps you, Karma would be appreciated.

Gene
Path Finder

Yes, I did. I have fixed problem by changing REGEX:
[discard_info]
REGEX = ^.*(THREAT,url,).*(informational).*$
DEST_KEY = queue
FORMAT = nullQueue

And also I have found that sourcetype needs to be pan:logs because with pan:thread - it is not working.

For now have additional problem trying to filter also events of pan:traffic and after editing transforms.conf file with additional stanza  :
[discard_traffic]
REGEX = ^.*(TRAFFIC,end).*(informational).*$
DEST_KEY = queue
FORMAT = nullQueue

and adding in props.conf discard_traffic - everything stops working... So I'm trying to figure out why this is happening

0 Karma

richgalloway
SplunkTrust
SplunkTrust

If your problem is resolved, then please click the "Accept as Solution" button to help future readers.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...