Splunk Search

how to send events to nullque?

knalla
Path Finder

Hi, how to exclude internal source IP events for a sourcetype (web_logs) with src_ip=10.0.0.0/8 before indexing.

0 Karma

shivanshu1593
Builder

You can actually save some licensing too, just by blacklisting the field, along with it's value in inputs.conf itself.

blacklist = src_ip = 10.0.0.0/8

Else, routing the data to null queue, as explained by @mguhad, will work too. I find blacklisting the data to be more helpful, when i know I don't need a portion of data at all. Why even bother to ingest it, when it has no use.

Thank you,
Shiv
###If you found the answer helpful, kindly consider upvoting/accepting it as the answer as it helps other Splunkers find the solutions to similar issues###
0 Karma

mguhad
Communicator

You can eliminate unwanted data by routing it to the nullQueue and it is removed before indexing with a combination of props and tranforms .conf like below:

props.conf:

[web_logs]
TRANSFORMS-removeIP= exclude

transforms.conf:

[exclude]
REGEX = src_ip=\d{2}\.\d{1}\.\d{1}\.\d{1}\/8$
DEST_KEY = queue
FORMAT = nullQueue

For methods to keep segments of the data and discard the rest, please the docs here:https://docs.splunk.com/Documentation/Splunk/8.0.1/Forwarding/Routeandfilterdatad

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...