Splunk Search

How to edit my props and transforms.conf to filter a subnet of logs from a destination IP address field?

takarthik
New Member

I am new to this concept. I am trying to filter the 10.0.0.0/8 subnet of logs from destination IP address field. I am trying to filter the logs in Splunk using props.conf & transforms.conf. Can you please help me in confirming if the applied props and transforms are correct, and also please let me know if the REGEX for filtering the destination IP address are correct.

Configurations in the props.conf

[Filter_Logs]
TRANSFORMS-null = null, Filter_Logs

Configurations in the transforms.conf,

[null]
REGEX = .
DEST_KEY = queue
FORMAT = indexQueue

[Filter_Logs]
REGEX = \|dest_ip\=^10.0.0.0/8$\|
DEST_KEY = queue
FORMAT = nullQueue

Thanks in advance.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

What does your data look like?

Even without seeing sample data, though, it's fairly certain your regex string will not produce the result you seek. The dots and slash within the IP address must be escaped. The ^ and $ anchors make no sense the way they are currently used.

Go to regex101. com to experiment with regex strings until you find what works with your data.

---
If this reply helps you, Karma would be appreciated.
0 Karma

takarthik
New Member

Thanks for your response Rich.

I modified the REGEX accordingly and it matched in REGEX101.com

^10.45.(0.([1-9]|[1-9][0-9]|1([0-9][0-9])|2([0-4][0-9]|5[0-5]))|([1-9]|[1-9][0-9]|1([0-9][0-9])|2([0-4][0-9]|5[0-5])).([0-9]|[1-9][0-9]|1([0-9][0-9])|2([0-4][0-9]|5[0-5])))$

On applying that in Splunk under transforms.conf that is not taking any effect.

Not sure if I am missing anything in the props and transforms.

transforms.conf

[setnull]
REGEX = \|dest\=^10.45.(0.([1-9]|[1-9][0-9]|1([0-9][0-9])|2([0-4][0-9]|5[0-5]))|([1-9]|[1-9][0-9]|1([0-9][0-9])|2([0-4][0-9]|5[0-5])).([0-9]|[1-9][0-9]|1([0-9][0-9])|2([0-4][0-9]|5[0-5])))$\|
REGEX = \|src\=^10.255.(0.([1-9]|[1-9][0-9]|1([0-9][0-9])|2([0-4][0-9]|5[0-5]))|([1-9]|[1-9][0-9]|1([0-9][0-9])|2([0-4][0-9]|5[0-5])).([0-9]|[1-9][0-9]|1([0-9][0-9])|2([0-4][0-9]|5[0-5])))$\|
DEST_KEY = queue
FORMAT = nullQueue

props.conf

[sourcetype name]
TRANSFORMS-set = setnull

Please help.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

You modified the regex strings, but didn't address the concerns I raised. The regexes are just more complex with the same problems. I suggest you get rid of the '^' and '$' characters. Then replace . with \..

I could be more specific with some sample data (sanitized, if necessary).

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...