All Apps and Add-ons

Palo Alto Networks App and Add-on for Splunk: Changes in transforms.conf are not working, how do I troubleshoot?

zhatsispgx
Path Finder

Hi there,

I am trying to filter out 'url' events from the Palo Alto Networks App and Add-on for Splunk because it is causing us to go over our license limit.

I have a transform that i put together in ./etc/apps/Splunk_TA_paloalto/default/props.conf :

[pan:threat]
SHOULD_LINEMERGE = false
# My addition below to Filter out URL Logs:
TRANSFORMS-urlfilter = urlfilter

and ./etc/apps/Splunk_TA_paloalto/default/transforms.conf

[urlfilter] 
REGEX=^.*(THREAT,url,).*(informational).*$
DEST_KEY=queue
FORMAT=nullQueue

After making these changes, I restarted splunk.

Where do i see debugging information as to why this doesn't work?

Also, if you can see why it isn't working can you please share? 🙂

Lastly, is there an easier way to do this: the field that i am searching for is already extracted with this TA:

field: log_subtype
value i am trying to avoid indexing: 'url'

0 Karma
1 Solution

niemesrw
Path Finder

We do something similar:

https://answers.splunk.com/answers/475294/palo-alto-networks-app-for-splunk-is-it-possible-t-1.html#...

In your particular case, try to pull the transform you're defining into the [pan:log] stanza in your props.conf. I seem to remember trying what you're doing and it didn't work under [pan:threat] - moving it up to pan:log worked - it might be some sort of race condition.

Also, put your work under /local - it should work just fine merging the changes and you won't lose them if you upgrade the TA.

View solution in original post

niemesrw
Path Finder

We do something similar:

https://answers.splunk.com/answers/475294/palo-alto-networks-app-for-splunk-is-it-possible-t-1.html#...

In your particular case, try to pull the transform you're defining into the [pan:log] stanza in your props.conf. I seem to remember trying what you're doing and it didn't work under [pan:threat] - moving it up to pan:log worked - it might be some sort of race condition.

Also, put your work under /local - it should work just fine merging the changes and you won't lose them if you upgrade the TA.

zhatsispgx
Path Finder

Thanks! that was it.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...