Splunk Search

How to filter out IPs from being indexed?

mcbradford
Contributor

I am not good at regex, so I need help filtering some IPs from being indexed.

raw event looks like this:

192.168.184.25 - - [26/Jan/2018:10:46:06 -0500] "HEAD / HTTP/1.0" 302 0 "-" "avi/1.0" "-"
192.168.184.26 - - [26/Jan/2018:10:46:06 -0500] "HEAD / HTTP/1.0" 302 0 "-" "avi/1.0" "-"

I also have data in the dataset coming from 23.99., so I want to exclude all data from the 23.99. range.

I was trying the following in transforms.conf on my Heavy Forwarder, but the events are still coming in. note - I just started with the 192.168.184.25

transforms.conf

[setnull]
REGEX = \,192\.168\.184\.25\,
DEST_KEY = queue
FORMAT = nullQueue

props.conf

[source::/var/log/nginx/access.log]
TRANSFORMS-null= setnull
0 Karma
1 Solution

mayurr98
Super Champion

try this

[setnull]
REGEX = 192\.168\.184\.25
DEST_KEY = queue
FORMAT = nullQueue

[source::/var/log/nginx/access.log]
TRANSFORMS-null = setnull

let me know if this helps!

View solution in original post

0 Karma

mayurr98
Super Champion

try this

[setnull]
REGEX = 192\.168\.184\.25
DEST_KEY = queue
FORMAT = nullQueue

[source::/var/log/nginx/access.log]
TRANSFORMS-null = setnull

let me know if this helps!

0 Karma

mcbradford
Contributor

This worked. If I wanted to exclude 192.168.184.25 and 192.168.184.26, could I do it with one statement?

I tired 192.168.184.* and this did not work.

0 Karma

mayurr98
Super Champion

Try this

192\.168\.184\.(25|26)
0 Karma
Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...