Dear Splunkers, can you please help with the following problem:
We use single instance and PaloAlto logs are sent through udp. We have a lot of noisy events which I want to send to nullQueue. I have created props.conf and transforms.conf files:
props:
[pan:threat]
TRANSFORMS_drop = discard_info
Transforms:
[discard_info]
REGEX = ,informational,
DEST_KEY = queue
FORMAT = nullQueue
short part of log, that contains "informational" which I want to filter: ,business-and-economy,informational,client-to-server,6966642515657316810,
For now events are not filtered out and I have no clue how to make it working, will really appreciate your help!
Yes, I did. I have fixed problem by changing REGEX:
[discard_info]
REGEX = ^.*(THREAT,url,).*(informational).*$
DEST_KEY = queue
FORMAT = nullQueue
And also I have found that sourcetype needs to be pan:logs because with pan:thread - it is not working.
For now have additional problem trying to filter also events of pan:traffic and after editing transforms.conf file with additional stanza :
[discard_traffic]
REGEX = ^.*(TRAFFIC,end).*(informational).*$
DEST_KEY = queue
FORMAT = nullQueue
and adding in props.conf discard_traffic - everything stops working... So I'm trying to figure out why this is happening
Did you restart Splunk after changing the .conf files? Does the incoming data have the expected sourcetype (pan:threat)?
Yes, I did. I have fixed problem by changing REGEX:
[discard_info]
REGEX = ^.*(THREAT,url,).*(informational).*$
DEST_KEY = queue
FORMAT = nullQueue
And also I have found that sourcetype needs to be pan:logs because with pan:thread - it is not working.
For now have additional problem trying to filter also events of pan:traffic and after editing transforms.conf file with additional stanza :
[discard_traffic]
REGEX = ^.*(TRAFFIC,end).*(informational).*$
DEST_KEY = queue
FORMAT = nullQueue
and adding in props.conf discard_traffic - everything stops working... So I'm trying to figure out why this is happening
If your problem is resolved, then please click the "Accept as Solution" button to help future readers.