Splunk Search

Regex - Filtering out unwanted events doesn't work

moey
New Member

Raw Cisco WSA squid event:

1533849492.277 0 192.168.1.11 TCP_DENIED/307 0 GET http://detectportal.firefox.com/success.txt - NONE/- - OTHER-NONE-AuthenticatedUsers-NONE-NONE-NONE-NONE <-,-,-,"-",-,-,-,-,"-",-,-,-,"-",-,-,"-","-",-,-,-,-,"-","-","-","-","-","-",0.00,0,-,"-","-",-,"-",-,-,"-","-",-,-,"-"> -

props.conf

[cisco:wsa:squid]
TRANSFORMS-null = tcpdenied307-firefox

transforms.conf

[tcpdenied307-firefox]
REGEX = .+(TCP_DENIED).+(307).+(detectportal.firefox.com).+
DEST_KEY = queue
FORMAT = nullQueue

Any ideas why my REGEX doesn't work?

Tags (1)
0 Karma

MuS
Legend

Hi there,

the regex works fine. Here are a few things to check:

  • Did you apply the props.conf / transforms.conf on the parsing instance (the first full Splunk instance that receives the events)?
  • Did you restart that Splunk instance after you applied the props/transforms?
  • no typo in the sourcetype name?
  • maybe use TRANSFORMS-nullQueue-tcpdenied307-firefox = tcpdenied307-firefox just to make sure the <class> is uniq.
  • it only applies to new data coming in, not historical data

cheers, MuS

0 Karma

moey
New Member

Hi,

  1. Yes, I deployed the props and transforms from my master node to my indexers and I can see them.
  2. According to the bundle distribution, I don't need to Splunk indexers.
  3. no typo, we've had successfully filter out unwanted events in the past similar to what I'm trying to do right now
  4. let me try that and see if it makes a difference
  5. yes, i'm still seeing in the new incoming data and it's weird that it's not working. we've done it before.

Thanks.

0 Karma

niketn
Legend

@moey check file permissions on props.conf and transforms.conf. It should be read only. You can compare file permission with other similar configurations.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...