How to reduce the cisco ASA logs using regex?

[kiran331]

Hi,

Is there a way to ignore a event containing the message before indexing using regex in props.conf and transforms.conf

ignore the msg contains "10.11.12.133 to 10.11.12.134 "?

[woodcock]

When you say "ignore" do you mean "prevent from being indexed" or "once indexed, prevent from showing in my search"?

Assuming the former:

http://docs.splunk.com/Documentation/Splunk/6.6.1/Forwarding/Routeandfilterdatad#Filter_event_data_a...

[somesoni2 · Accepted solution]

You can follow instructions from below link on dropping specific events ( containing those IP addresses) and index the rest.

http://docs.splunk.com/Documentation/Splunk/6.5.2/Forwarding/Routeandfilterdatad#Discard_specific_ev...

On INdexer/Heavy Forwarder (whichever comes first in flow)
In props.conf, set the TRANSFORMS-null attribute:
[

[YourSourceTypeNameHere]
TRANSFORMS-null= setnull

Create a corresponding stanza in transforms.conf. Set DEST_KEY to "queue" and FORMAT to "nullQueue":

[setnull]
REGEX = (10\.11\.12\.133|10\.11\.12\.134)
DEST_KEY = queue
FORMAT = nullQueue

Restart Splunk Enterprise.

[kiran331]

Hi,

I also have 2 more IP's to avoid before Indexing, 169.225.1.2.3 and 165.244.253.255, Do I have to create new stanza Or I can use the old one to add Ip's?

[horsefez]

just add them to the existing stanza like this

(10\.11\.12\.133|10\.11\.12\.134|<next-ip>|<next-ip>)

[kiran331]

Thank you

[kiran331]

Hi somesoni2,

I added this on Heavy Forwarder and also On indexers, I changed it to ignore any logs containing 169.244.255.255. I still see the logs indexing,

I added the below in props.conf and transforms.conf.

props.conf

[cisco:asa]
TRANSFORMS-null= setnull

[setnull]
REGEX = (169.254.255.255)
DEST_KEY = queue
FORMAT = nullQueue

[horsefez]

Hi,
maybe try to "escape" the dots in your regex.

Like this: (169\.254\.255\.255)

[kiran331]

Hi,

I'm using . , It was changed in the comment.

[somesoni2]

Did you restart Splunk after making the change? ALso, this filter will be applicable for any data that'll come after you made the change, any older data would remain as is.

[kiran331]

Thank you it worked.