I'm trying to filter off events based on the following command: CMD for example.
Heres the sample event and my configuration:
Dec 11 23:53:49 10.138.20.37 Dec 11 23:51:54 myServer ABC:0|ABC|XYZ|1.0|ABC0001|A command (CMD) was run.|3|src=220.127.116.11 ....
[18.104.22.168] TRANSFORMS-null = setnull
[setnull] REGEX = (?i)command \\((?CMD.*)\\) DEST_KEY = queue FORMAT = nullQueue
This is so that it does not get indexed and add on to the license as the event is generating huge volume of logs. However I'm not able to filter off the event.
Appreciate any help for the regex?..thanks
I've also tried the following regex but doesn't work:
In props.conf,we've moved the line
TRANSFORMS-null=setnull to the stanza [syslog] instead, and it works..but it simply filters off all the events that has
CMD regardless of host.
I've tried using the stanza [host::22.214.171.124] but it doesn't work.
I'm trying to filter off events that has
CMD in it from the host 126.96.36.199.
First of all, are you sure that the stanza you defined in props.conf is applied to the data you want to filter? Is your sourcetype really "188.8.131.52"? If you want the stanza to be applied based on source host you should use [host::184.108.40.206] instead.
As for the regex, the first one in the updated section should work (though it probably catches stuff it shouldn't as well). Something like this should work if the events you want to filter always contain "command (CMD)": REGEX = command \(CMD\)
...or, if the first part is static but the actual command differs: REGEX = command \([^\)]+\)