Whitelist _raw with Regex string in Inputs.conf

[zekiramhi]

Hello,

I was wondering if the title is possible, injesting only specific strings or regex that match onto Splunk

Regards

[inventsekar]

>>> So I should proceed with "Keep specific events and discard the rest" header, and implement that to either my indexer or hf to only get fred for example. correct?

Yes, exactly.. HF is better or.. indexer also fine. 

[gcusello · Accepted solution]

Hi @zekiramhi,

let me understand: you want to filter your data for specific regexes, is it correct?

If this is you need you can filter logs only on Indexers (or Heavy Forwarders when present), with the only exception of Wineventlogs that can be filtered also on Universal Forwarders.

Anyway, to filter events see https://docs.splunk.com/Documentation/Splunk/8.1.0/Forwarding/Routeandfilterdatad#Filter_event_data_...

Ciao.

Giuseppe

[zekiramhi]

Hello Giuseppe,

Yes exactly, I have a deployment app that I want to use to log events that only include a specific string in a specific area of the log in which I can regex to it.

example:

Mar 14 20:20:53 server sshd[10091]: Accepted publickey for fred from 192.0.2.60 port 59941 ssh2: RSA SHA256:LI/TSnwoLryuYisAnNEIedVBXwl/XsrXjli9Qw9SmwI
Mar 14 20:20:53 server internal-sftp[31070]: session opened for local user fred from [192.0.2.60]

and only get logs that match "fred"

So I should proceed with "Keep specific events and discard the rest" header, and implement that to either my indexer or hf to only get fred for example. correct?

[gcusello]

hi @zekiramhi,

Yes exactly: you have to implement a filter on your Indexers or (if present) on HF.

Obviously you lose the logs you discard and you cannot use them more.

Ciao and good splunking.

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉