Splunk Enterprise Security

ESS SEP, Check Point and TippingPoint TA Filters

ephemeric
Contributor

Hi,

We're using the above and I was wondering if it is possible to filter out some unneeded event data to decrease index usage?

I've looked at the TA props and transforms quickly, it doesn't seem so obvious to me right now.

Thanks.

0 Karma
1 Solution

hazekamp
Builder

ephemeric,

The ability to "null-queue" incoming data based on regular expression is native to Splunk. Since you have ESS in place you could put the props/transforms for your respective data sets in local directory of the TA. Keep in mind these are operations that are performed at index time, so those TA's should be pushed down to your indexers via deployment server.

## props.conf:
[tippingpoint]
TRANSFORMS-null_queue_for_tippingpoint = null_queue_for_tippingpoint

## transforms.conf:
[null_queue_for_tippingpoint]
REGEX = <your_regex_here>
DEST_KEY = queue
FORMAT = nullQueue

Here's some additional resources if needed:

http://answers.splunk.com/questions/11617/route-unwanted-logs-to-a-null-queue

http://www.splunk.com/base/Documentation/latest/Admin/Propsconf

http://www.splunk.com/base/Documentation/latest/Admin/Transformsconf

View solution in original post

hazekamp
Builder

ephemeric,

The ability to "null-queue" incoming data based on regular expression is native to Splunk. Since you have ESS in place you could put the props/transforms for your respective data sets in local directory of the TA. Keep in mind these are operations that are performed at index time, so those TA's should be pushed down to your indexers via deployment server.

## props.conf:
[tippingpoint]
TRANSFORMS-null_queue_for_tippingpoint = null_queue_for_tippingpoint

## transforms.conf:
[null_queue_for_tippingpoint]
REGEX = <your_regex_here>
DEST_KEY = queue
FORMAT = nullQueue

Here's some additional resources if needed:

http://answers.splunk.com/questions/11617/route-unwanted-logs-to-a-null-queue

http://www.splunk.com/base/Documentation/latest/Admin/Propsconf

http://www.splunk.com/base/Documentation/latest/Admin/Transformsconf

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...