Splunk Enterprise Security

Splunk - Enterprise Security - Disable Splunk Web Messages

SMWickman
Explorer

How can I selectively disable/suppress Splunk web messages? This one is quite a nuisance and quite obviously a bug of some kind:

Splunk_SA_CIM version 4.11.0 is lower than required 4.9.1
6/19/2018, 12:46:13 PM

It's starting to get a bit annoying clearing it over and over. 4.11.0 is obviously a higher version than 4.9.1 but I presume whatever is driving this message is only reading to 4.1* and interpreting that as a lower version.

Any help here would be hugely helpful!

darrenfuller
Contributor

If you are looking to get rid of those messages altogether, you could use props / transforms to get rid of those events at index time...

#props.conf 

[sourcetype-of-annoying-event]
TRANSFORMS-get_rid_of_annoying_messages = shred_useless_cim_events


#transforms.conf

[shred_useless_cim_events]
SOURCE_KEY = _raw
DEST_KEY = queue
FORMAT = nullQueue
REGEX = Splunk_SA_CIM\sversion\s4\.11\.0\sis\slower\sthan\srequired\s4\.9\.1

... These would need to be put on your indexers and / or heavy forwarders, depending on how data is coming into Splunk.

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...