Dear Splunk Support, I am encountering an issue while configuring Splunk to filter logs based on specific ports (21, 22, 23, 3389) using props.conf and transforms.conf. Despite following the proper configuration steps, the filtering is not working as expected. Below are the details: System Details: Splunk Version: [9.3.2] Deployment Type: Heavy Forwarder Log Source: /opt/log/indexsource/* Configuration Applied: props.conf (Located at $SPLUNK_HOME/etc/system/local/props.conf) [source::/opt/log/indexsource/*] TRANSFORMS-filter_ports = filter_specific_ports transforms.conf (Located at $SPLUNK_HOME/etc/system/local/transforms.conf) [filter_specific_ports] REGEX = .* (21|22|23|3389) .* DEST_KEY = queue FORMAT = indexQueue And trying someways such as: transforms.conf: [filter_ports] REGEX = (21|22|23|3389) DEST_KEY = queue FORMAT = indexQueue [drop_other_ports] REGEX = . DEST_KEY = queue FORMAT = nullQueueAnd AND props.conf: [source::your_specific_source] TRANSFORMS-filter_ports = allow_ports, drop_other_ports transforms.conf: [allow_ports] REGEX = (21|22|23|3389) DEST_KEY = _MetaData:Index FORMAT = your_index_name [drop_other_ports] REGEX = . DEST_KEY = queue FORMAT = nullQueue Issue Observed: The expected behavior is that logs containing these ports should be routed to indexQueue, but they are not being filtered as expected. All logs are still being indexed in the default index. Checked for syntax errors and restarted Splunk, but the issue persists. Troubleshooting Steps Taken: Verified Regex: Confirmed that the regex .* (21|22|23|3389) .* correctly matches log lines using regex testing tools. Checked Splunk Logs: Looked for errors in $SPLUNK_HOME/var/log/splunk/splunkd.log but found no related warnings. Restarted Splunk: Restarted the service after configuration changes using splunk restart. Checked Events in Splunk: Ran searches to confirm that logs with these ports were still being indexed. Request for Assistance: Could you please advise on: Whether there are any syntax issues in my configuration? If additional debugging steps are needed? Alternative methods to ensure only logs containing ports 21, 22, 23, and 3389 are routed correctly? Your assistance in resolving this issue would be greatly appreciated. Best regards, Namchin Baranzad Information Security Analyst M Bank Email: namchin.b@m-bank.mn
... View more
