Getting Data In

Not Able to send data to Null Queue

istutig
Loves-to-Learn Lots

Hi
How to edit props.conf or blacklist the sub sourcetype

Have integrated PALO ALTO logs to Splunk it is fetching 3 sourcetypes. The pan:log sourcetyoe having pan:userid as sub sourcetype, it's generating alot of events so I want to discard them.
Tried with the Null Queue but the problem is for 1-minute window the userid is not coming whereas for 5-minute window it is coming.

props.conf:
[source::udp:514]
TRANSFORMS-null_syslogs=pa_useridnull

transforms:
[pa_useridnull]
REGEX = type=USERID
DEST_KEY = queue
FORMAT = nullQueue

0 Karma
1 Solution

Wallace44
Explorer

I don't believe you can use type=USERID because that is a post index key pair that's generated. That regex won't match the raw logs.

I'd suggest exporting a chunk of your logs, and then going to a regex builder site and modifying your regex to match. Most regex builder sites have a tool where you can paste data and it will highlight what your regex matches. regexr.com is a site that you might find handy.

View solution in original post

0 Karma

rc15
Observer

Hi,

 

We are having same problem. Can you please provide solution if issue is resolved?

0 Karma

Wallace44
Explorer

Based on my PA logs, regex of USERID,login would match the logs you want, however YMMV as I cannot see what logs you've got coming in to Splunk.

0 Karma

Wallace44
Explorer

I don't believe you can use type=USERID because that is a post index key pair that's generated. That regex won't match the raw logs.

I'd suggest exporting a chunk of your logs, and then going to a regex builder site and modifying your regex to match. Most regex builder sites have a tool where you can paste data and it will highlight what your regex matches. regexr.com is a site that you might find handy.

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...