Splunk Enterprise Security

ESS SEP, Check Point and TippingPoint TA Filters

ephemeric
Contributor

Hi,

We're using the above and I was wondering if it is possible to filter out some unneeded event data to decrease index usage?

I've looked at the TA props and transforms quickly, it doesn't seem so obvious to me right now.

Thanks.

0 Karma
1 Solution

hazekamp
Builder

ephemeric,

The ability to "null-queue" incoming data based on regular expression is native to Splunk. Since you have ESS in place you could put the props/transforms for your respective data sets in local directory of the TA. Keep in mind these are operations that are performed at index time, so those TA's should be pushed down to your indexers via deployment server.

## props.conf:
[tippingpoint]
TRANSFORMS-null_queue_for_tippingpoint = null_queue_for_tippingpoint

## transforms.conf:
[null_queue_for_tippingpoint]
REGEX = <your_regex_here>
DEST_KEY = queue
FORMAT = nullQueue

Here's some additional resources if needed:

http://answers.splunk.com/questions/11617/route-unwanted-logs-to-a-null-queue

http://www.splunk.com/base/Documentation/latest/Admin/Propsconf

http://www.splunk.com/base/Documentation/latest/Admin/Transformsconf

View solution in original post

hazekamp
Builder

ephemeric,

The ability to "null-queue" incoming data based on regular expression is native to Splunk. Since you have ESS in place you could put the props/transforms for your respective data sets in local directory of the TA. Keep in mind these are operations that are performed at index time, so those TA's should be pushed down to your indexers via deployment server.

## props.conf:
[tippingpoint]
TRANSFORMS-null_queue_for_tippingpoint = null_queue_for_tippingpoint

## transforms.conf:
[null_queue_for_tippingpoint]
REGEX = <your_regex_here>
DEST_KEY = queue
FORMAT = nullQueue

Here's some additional resources if needed:

http://answers.splunk.com/questions/11617/route-unwanted-logs-to-a-null-queue

http://www.splunk.com/base/Documentation/latest/Admin/Propsconf

http://www.splunk.com/base/Documentation/latest/Admin/Transformsconf

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...