Splunk Search

how to prevent specific syslog events from being collected?

bjork6
New Member

Hi. I am new to Splunk and I am trying to prevent specific logs to be collected. I have 3 Etehrnet switches and they generate a lot of garbage and I don't want my logs to be filled by unnecessary entries. I already know that I need to create "stuff" inside props.conf and transforms.conf.

In fact, what I want to do is to send to the nullQueue everything that comes from port udp 514 and that contains the word MSGBUILDER inside the _raw field.

Here is what I did:

Props.conf

[source::UDP:514]
TRANSFORMS-set= setnull

Transforms.conf

[setnull]
REGEX= MSGBUILDER
DEST_KEY = queue
FORMAT = nullQueue

There must be something I do not do properly because it doesn't work. Splunk continues to collect these logs instead of excluding them.

Anyone can help?

Thanks.

0 Karma

bjork6
New Member

Hi jonuwz,

thanks for your answer but it's my mistake. I typed UDP (UPPER CASE) here but I definitely wrote udp (lower case) in props.conf.

Another idea someone?

Thanks.

0 Karma

jonuwz
Influencer

Pretty sure UDP should be udp in props.conf

[source::udp:514]
TRANSFORMS-set= setnull

Update....

Have you restarted splunk since making the changes?

0 Karma

jonuwz
Influencer

You're welcome.

0 Karma

bjork6
New Member

Guess what? Either I'm lying or I must be blind but you were absolutely right. I double checked it this morning and udp was typed in UPPER CASE. Now it seems to work like a charm. Thank you very much.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...