Getting Data In

Not Able to send data to Null Queue

istutig
Loves-to-Learn Lots

Hi
How to edit props.conf or blacklist the sub sourcetype

Have integrated PALO ALTO logs to Splunk it is fetching 3 sourcetypes. The pan:log sourcetyoe having pan:userid as sub sourcetype, it's generating alot of events so I want to discard them.
Tried with the Null Queue but the problem is for 1-minute window the userid is not coming whereas for 5-minute window it is coming.

props.conf:
[source::udp:514]
TRANSFORMS-null_syslogs=pa_useridnull

transforms:
[pa_useridnull]
REGEX = type=USERID
DEST_KEY = queue
FORMAT = nullQueue

0 Karma
1 Solution

Wallace44
Explorer

I don't believe you can use type=USERID because that is a post index key pair that's generated. That regex won't match the raw logs.

I'd suggest exporting a chunk of your logs, and then going to a regex builder site and modifying your regex to match. Most regex builder sites have a tool where you can paste data and it will highlight what your regex matches. regexr.com is a site that you might find handy.

View solution in original post

0 Karma

rc15
Observer

Hi,

 

We are having same problem. Can you please provide solution if issue is resolved?

0 Karma

Wallace44
Explorer

Based on my PA logs, regex of USERID,login would match the logs you want, however YMMV as I cannot see what logs you've got coming in to Splunk.

0 Karma

Wallace44
Explorer

I don't believe you can use type=USERID because that is a post index key pair that's generated. That regex won't match the raw logs.

I'd suggest exporting a chunk of your logs, and then going to a regex builder site and modifying your regex to match. Most regex builder sites have a tool where you can paste data and it will highlight what your regex matches. regexr.com is a site that you might find handy.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...