Splunk Search

How to edit my props and transforms.conf to filter a subnet of logs from a destination IP address field?

takarthik
New Member

I am new to this concept. I am trying to filter the 10.0.0.0/8 subnet of logs from destination IP address field. I am trying to filter the logs in Splunk using props.conf & transforms.conf. Can you please help me in confirming if the applied props and transforms are correct, and also please let me know if the REGEX for filtering the destination IP address are correct.

Configurations in the props.conf

[Filter_Logs]
TRANSFORMS-null = null, Filter_Logs

Configurations in the transforms.conf,

[null]
REGEX = .
DEST_KEY = queue
FORMAT = indexQueue

[Filter_Logs]
REGEX = \|dest_ip\=^10.0.0.0/8$\|
DEST_KEY = queue
FORMAT = nullQueue

Thanks in advance.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

What does your data look like?

Even without seeing sample data, though, it's fairly certain your regex string will not produce the result you seek. The dots and slash within the IP address must be escaped. The ^ and $ anchors make no sense the way they are currently used.

Go to regex101. com to experiment with regex strings until you find what works with your data.

---
If this reply helps you, Karma would be appreciated.
0 Karma

takarthik
New Member

Thanks for your response Rich.

I modified the REGEX accordingly and it matched in REGEX101.com

^10.45.(0.([1-9]|[1-9][0-9]|1([0-9][0-9])|2([0-4][0-9]|5[0-5]))|([1-9]|[1-9][0-9]|1([0-9][0-9])|2([0-4][0-9]|5[0-5])).([0-9]|[1-9][0-9]|1([0-9][0-9])|2([0-4][0-9]|5[0-5])))$

On applying that in Splunk under transforms.conf that is not taking any effect.

Not sure if I am missing anything in the props and transforms.

transforms.conf

[setnull]
REGEX = \|dest\=^10.45.(0.([1-9]|[1-9][0-9]|1([0-9][0-9])|2([0-4][0-9]|5[0-5]))|([1-9]|[1-9][0-9]|1([0-9][0-9])|2([0-4][0-9]|5[0-5])).([0-9]|[1-9][0-9]|1([0-9][0-9])|2([0-4][0-9]|5[0-5])))$\|
REGEX = \|src\=^10.255.(0.([1-9]|[1-9][0-9]|1([0-9][0-9])|2([0-4][0-9]|5[0-5]))|([1-9]|[1-9][0-9]|1([0-9][0-9])|2([0-4][0-9]|5[0-5])).([0-9]|[1-9][0-9]|1([0-9][0-9])|2([0-4][0-9]|5[0-5])))$\|
DEST_KEY = queue
FORMAT = nullQueue

props.conf

[sourcetype name]
TRANSFORMS-set = setnull

Please help.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

You modified the regex strings, but didn't address the concerns I raised. The regexes are just more complex with the same problems. I suggest you get rid of the '^' and '$' characters. Then replace . with \..

I could be more specific with some sample data (sanitized, if necessary).

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...