Splunk Search

regex wimp

chowell
Explorer

I have this in a transforms.conf file on one of my forwarders. My goal is to drop everything from either of the IP's, but they keep coming through. What am I doing wrong?

[setnull]
REGEX = .*(10\.3\.0\.(11|12)).*
DEST_KEY = queue
FORMAT = nullQueue

[setparsing]
REGEX = .
DEST_KEY = queue
FORMAT = indexQueue

THanks,

--Carl

Tags (1)

landen99
Motivator

My bet is that your ip exists in the host field and not in the _raw text.

[setnull]
REGEX = 10\.3\.0\.1[12]
SOURCE_KEY=MetaData:Host
DEST_KEY = queue
FORMAT = nullQueue
0 Karma

ftk
Motivator

You don't have to include your wildcards in the front and back. Give it a try as follows:

[setnull]
REGEX = 10\.3\.0\.(11|12)
DEST_KEY = queue
FORMAT = nullQueue

Also make sure that you are actually applying this routing rule to your applicable sourcetype in props.conf....e.g.

[mysourcetype]
TRANSFORMS-setnull = setnull
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...