Splunk Search

Regex - Filtering out unwanted events doesn't work

moey
New Member

Raw Cisco WSA squid event:

1533849492.277 0 192.168.1.11 TCP_DENIED/307 0 GET http://detectportal.firefox.com/success.txt - NONE/- - OTHER-NONE-AuthenticatedUsers-NONE-NONE-NONE-NONE <-,-,-,"-",-,-,-,-,"-",-,-,-,"-",-,-,"-","-",-,-,-,-,"-","-","-","-","-","-",0.00,0,-,"-","-",-,"-",-,-,"-","-",-,-,"-"> -

props.conf

[cisco:wsa:squid]
TRANSFORMS-null = tcpdenied307-firefox

transforms.conf

[tcpdenied307-firefox]
REGEX = .+(TCP_DENIED).+(307).+(detectportal.firefox.com).+
DEST_KEY = queue
FORMAT = nullQueue

Any ideas why my REGEX doesn't work?

Tags (1)
0 Karma

MuS
Legend

Hi there,

the regex works fine. Here are a few things to check:

  • Did you apply the props.conf / transforms.conf on the parsing instance (the first full Splunk instance that receives the events)?
  • Did you restart that Splunk instance after you applied the props/transforms?
  • no typo in the sourcetype name?
  • maybe use TRANSFORMS-nullQueue-tcpdenied307-firefox = tcpdenied307-firefox just to make sure the <class> is uniq.
  • it only applies to new data coming in, not historical data

cheers, MuS

0 Karma

moey
New Member

Hi,

  1. Yes, I deployed the props and transforms from my master node to my indexers and I can see them.
  2. According to the bundle distribution, I don't need to Splunk indexers.
  3. no typo, we've had successfully filter out unwanted events in the past similar to what I'm trying to do right now
  4. let me try that and see if it makes a difference
  5. yes, i'm still seeing in the new incoming data and it's weird that it's not working. we've done it before.

Thanks.

0 Karma

niketn
Legend

@moey check file permissions on props.conf and transforms.conf. It should be read only. You can compare file permission with other similar configurations.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform

 Are you ready to revolutionize your IT operations? As digital transformation accelerates, the demand for ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...

Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...

Financial services organizations face an impossible equation: maintain 99.9% uptime for mission-critical ...