We are trying to filter out events from a Syslog server that is ingesting data for a number of sources but the one we are trying to filter is from our Meraki devices.  Each Meraki is considered a source and the sourcetype is meraki.  This is a sample of the events coming into Splunk: 2022-07-08 07:14:51.427 xxx.xxx.xxx.xxx 1 Location_XXX flows src=xxx.xxx.0.1 dst=8.8.8.8 mac=70:D3:79:XX:XX:XX protocol=icmp type=8 pattern: allow icmp host = xxx.xx.0.2source = /syslog0/syslog/meraki/xxx.xx.0.2/messages.log sourcetype = meraki There are more than 100 sources all using the format:  /syslog0/syslog/meraki/<IP Address>/messages.log How can I put that source in props.conf without listing each one separately?  ... View more

We have a home grown application that pings Google DNS on a regular basis.  We are ingesting the data from our Meraki wireless devices and I would like to filter out the ICMP messages with the destination of 8.8.8.8.  Our events look like this: 7/8/22 8:14:51.427 AM 2022-07-08 07:14:51.427 xxx.xxx.xxx.xxx 1 Location_XXX flows src=xxx.xxx.0.1 dst=8.8.8.8 mac=70:D3:79:XX:XX:XX protocol=icmp type=8 pattern: allow icmp host = xxx.xx.0.2source = /syslog0/syslog/meraki/xxx.xx.0.2/messages.log sourcetype = meraki What would be the most efficient way to filter these messages to help reduce license usage?  ... View more

We have a Syslog server collecting data from Meraki Wireless devices.  There is a UF installed on the Syslog server sending data to Splunk.  I have been trying to use Blacklist to filter out the ICMP protocol events which we don't need and I have been unable to drop them.  The entry in my inputs.conf file for this are: [monitor:///syslog0/syslog/meraki/*/*.log] disabled=0 host_segment = 4 blacklist1 = protocol=icmp blacklist2 = "(?192.\168.\30.\143.)" blacklist3 = 10.\12.\239.\7 index = network sourcetype = meraki I have tried a number of variations and have been unable to get the "protocol=icmp" to drop.  Is there something obvious that I am missing? Thanks in advance for any suggestions. ... View more