Hello,
I have a firewall that sends a lot of data, i would like to filter events using a specific field value (exemple whitelist field="value")
my stanza is like this :
[udp://516]
connection_host = ip
sourcetype = stonegate
whitelist = deviceExternalId="value"
This didn't work and i still get all of data.
Any help please ?
thanks
Hi Afef
The correct way is
In props.conf
[stonegate]
TRANSFORMS-erase = eventerase
in transforms.conf
[eventerase]
REGEX= deviceExternalId\=\"value\" <<--- the regular expresion that match the events that you want to filter
DEST_KEY=queue
FORMAT=nullQueue
Hope help you
It won't work unless you remove the comment string ( <<--- the regular expresion that match the events that you want to filter
). That is probably all that is wrong; otherwise this solution should work.
This did not work for me !
i have events like this :
Dec 18 13:54:29 10.1.140.3 CEF:0|McAfee|Firewall|5.7.5|70018|Connection_Allowed|0|spt=31579 deviceExternalId=ExempleValue-FW node 1.....
I did the config on props.conf & transforms.conf but i still have data in
Have you restart splunk after configure the props.conf and transforms.conf?
Can you add the content of the config files just to check the configuration?
And also, where the did you configure these files? indexer i hope
yes i restarted the splunk server (yes the indexer , i have one splunk isntance)
the config :
In props.conf
[stonegate]
TRANSFORMS-erase = eventerase
in transforms.conf
[eventerase]
REGEX= deviceExternalId\=\"ExempleValue-FW\"
DEST_KEY=queue
FORMAT=nullQueue
Hi,
I think the error is in the regex, please use this one
REGEX= deviceExternalId\=ExempleValue\-FW
Thanks for your answer it works 🙂
If i would like to put many values :
REGEX= deviceExternalId=(ExempleValue-FW|ExempleValue2-FW) ?
Yes,
But remember to escape the -
🙂
yes yes
REGEX= deviceExternalId=(ExempleValue-FW|ExempleValue2-FW)
Thank you 🙂
And also remember to scape the second =
REGEX= deviceExternalId\=(ExempleValue\-FW|ExempleValue2\-FW)
De nada
If you want to filter data you have to play with the props and transforms files.
Take a look at this:
Keep in mind this is not going to work on Universal Forwarders so make sure you are running it on a full enterprise installation.
Thanks,
J