Splunk Search

Whitelist _raw with Regex string in Inputs.conf

zekiramhi
Path Finder

Hello,

I was wondering if the title is possible, injesting only specific strings or regex that match onto Splunk

Regards

Labels (3)
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @zekiramhi,

let me understand: you want to filter your data for specific regexes, is it correct?

If this is you need you can filter logs only on Indexers (or Heavy Forwarders when present), with the only exception of Wineventlogs that can be filtered also on Universal Forwarders.

Anyway, to filter events see https://docs.splunk.com/Documentation/Splunk/8.1.0/Forwarding/Routeandfilterdatad#Filter_event_data_...

Ciao.

Giuseppe

View solution in original post

inventsekar
SplunkTrust
SplunkTrust

>>> So I should proceed with "Keep specific events and discard the rest" header, and implement that to either my indexer or hf to only get fred for example. correct?

Yes, exactly.. HF is better or.. indexer also fine. 

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !

gcusello
SplunkTrust
SplunkTrust

Hi @zekiramhi,

let me understand: you want to filter your data for specific regexes, is it correct?

If this is you need you can filter logs only on Indexers (or Heavy Forwarders when present), with the only exception of Wineventlogs that can be filtered also on Universal Forwarders.

Anyway, to filter events see https://docs.splunk.com/Documentation/Splunk/8.1.0/Forwarding/Routeandfilterdatad#Filter_event_data_...

Ciao.

Giuseppe

zekiramhi
Path Finder

Hello Giuseppe,

Yes exactly, I have a deployment app that I want to use to log events that only include a specific string in a specific area of the log in which I can regex to it.

example:

Mar 14 20:20:53 server sshd[10091]: Accepted publickey for fred from 192.0.2.60 port 59941 ssh2: RSA SHA256:LI/TSnwoLryuYisAnNEIedVBXwl/XsrXjli9Qw9SmwI
Mar 14 20:20:53 server internal-sftp[31070]: session opened for local user fred from [192.0.2.60]

and only get logs that match "fred"

So I should proceed with "Keep specific events and discard the rest" header, and implement that to either my indexer or hf to only get fred for example. correct?

gcusello
SplunkTrust
SplunkTrust

hi @zekiramhi,

Yes exactly: you have to implement a filter on your Indexers or (if present) on HF.

Obviously you lose the logs you discard and you cannot use them more.

Ciao and good splunking.

Giuseppe

P.S.: Karma Points are appreciated by all the contributors :winking_face:

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...