Hi All, I require to exclude events when the 'dest_port=80'. I have gone through other similar examples and have come to the conclusion that it is more poor REGEX skills causing the issue. The stream data (netflow v9) goes through a heavy forwarder (HF) prior to the IDX. Below is the props.conf and transforms.conf of the HF, as well as event log: props.conf: [stream:netflow] TRANSFORMS-null= setnull transforms.conf: [setnull] REGEX = "dest_port":53 DEST_KEY = queue FORMAT = nullQueue I have also tried other REGEX, such as "(\w+)":80 , "([^\"]+)\":80 but they dont seem to be working. Event log: {"dest_ip":"123.456.789.99","dest_port":80,"event_name":"netFlowData","exporter_ip":"192.192.192.192","exporter_time":"2018-Jan-08 03:47:21","exporter_uptime":1269091254,"firewall_event":1,"flow_id":2950442453,"flow_start_time_milli":1546919225527,"input_snmpidx":5,"netflow_elements":["UNKNOWN : 0000","UNKNOWN : fa14fc27d49102c0abdf8bd4","UNKNOWN : 000000000000000000000000","UNKNOWN : Any help would be great. Thanks in advance ... View more

Hi All, I currently have a UF installed on a host sending windows security logs to index=wineventlogs in non-XML format (which is what I want). The issue is that the same host is sending the window security logs in xml to index=main, and I cannot find the reason why. I have installed the Splunk App for Win Infra (1.5.0), Win_TA (5.0.1) and Splunk Add on for AD/DNS (1.0.0/1.0.1) on my SH, IDX and UF (where needed, as per Splunk documentation) My guess here is that is something to do with one of the above apps installed, as the UF has the following inputs.conf under the 'etc/app/Splunk_TA_Windows\local\'. No other local files on the UF. inputs.conf on the UF: [WinEventLog://Security] disabled=0 index=wineventlog renderXml=false ..............(other default data - start_from, current_only etc) I have used btool on the host UF (inputs and ouputs list) as well as the IDX (inputs, props and transforms list), though I cant seem to find the issue. I have also go through the Windows Add On upgrade documentation. Any further advice/tips would be very appreciated (i.e. what to specifically look for using btool or potential root causes) Cheers. ... View more