Regex - Filtering out unwanted events doesn't work

[moey]

Raw Cisco WSA squid event:

1533849492.277 0 192.168.1.11 TCP_DENIED/307 0 GET http://detectportal.firefox.com/success.txt - NONE/- - OTHER-NONE-AuthenticatedUsers-NONE-NONE-NONE-NONE <-,-,-,"-",-,-,-,-,"-",-,-,-,"-",-,-,"-","-",-,-,-,-,"-","-","-","-","-","-",0.00,0,-,"-","-",-,"-",-,-,"-","-",-,-,"-"> -

props.conf

[cisco:wsa:squid]
TRANSFORMS-null = tcpdenied307-firefox

transforms.conf

[tcpdenied307-firefox]
REGEX = .+(TCP_DENIED).+(307).+(detectportal.firefox.com).+
DEST_KEY = queue
FORMAT = nullQueue

Any ideas why my REGEX doesn't work?

[MuS]

Hi there,

the regex works fine. Here are a few things to check:

• Did you apply the props.conf / transforms.conf on the parsing instance (the first full Splunk instance that receives the events)?
• Did you restart that Splunk instance after you applied the props/transforms?
• no typo in the sourcetype name?
• maybe use TRANSFORMS-nullQueue-tcpdenied307-firefox = tcpdenied307-firefox just to make sure the <class> is uniq.
• it only applies to new data coming in, not historical data

cheers, MuS

[moey]

Hi,

1. Yes, I deployed the props and transforms from my master node to my indexers and I can see them.
2. According to the bundle distribution, I don't need to Splunk indexers.
3. no typo, we've had successfully filter out unwanted events in the past similar to what I'm trying to do right now
4. let me try that and see if it makes a difference
5. yes, i'm still seeing in the new incoming data and it's weird that it's not working. we've done it before.

Thanks.

[niketn]

@moey check file permissions on props.conf and transforms.conf. It should be read only. You can compare file permission with other similar configurations.