Filtering PaloAlto events

[Gene]

Dear Splunkers, can you please help with the following problem:

We use single instance and PaloAlto logs are sent through udp. We have a lot of noisy events which I want to send to nullQueue. I have created props.conf and transforms.conf files:
props:
[pan:threat]
TRANSFORMS_drop = discard_info

Transforms:
[discard_info]
REGEX = ,informational,
DEST_KEY = queue
FORMAT = nullQueue

short part of log, that contains "informational" which I want to filter:   ,business-and-economy,informational,client-to-server,6966642515657316810,

For now events are not filtered out and I have no clue how to make it working, will really appreciate your help!

[richgalloway]

Did you restart Splunk after changing the .conf files?  Does the incoming data have the expected sourcetype (pan:threat)?

[Gene · Accepted solution]

Yes, I did. I have fixed problem by changing REGEX:
[discard_info]
REGEX = ^.*(THREAT,url,).*(informational).*$
DEST_KEY = queue
FORMAT = nullQueue

And also I have found that sourcetype needs to be pan:logs because with pan:thread - it is not working.

For now have additional problem trying to filter also events of pan:traffic and after editing transforms.conf file with additional stanza  :
[discard_traffic]
REGEX = ^.*(TRAFFIC,end).*(informational).*$
DEST_KEY = queue
FORMAT = nullQueue

and adding in props.conf discard_traffic - everything stops working... So I'm trying to figure out why this is happening

[richgalloway]

If your problem is resolved, then please click the "Accept as Solution" button to help future readers.