Splunk Search

Blocking messages because license is exceeded (Sidewinder Firewall)

Michael_Schyma1
Contributor

The message below is the events coming through on our SideWinder Firewalls (debug messages). I am trying to filter out these messages by t_debug because they are in 100% of these messages. Does anyone have any suggestions or ideas of how to get these events blocked.

  Nov  8 08:26:07 web.com Nov  8 08:26:06 iwalld auditd: date="Nov  8 13:26:06 2012 UTC",fac=f_acld,area=a_server,type=t_debug,pri=p_minor,pid=2978,ruid=0,euid=0,pgid=2978,logid=0,cmd=acld,domain=Acld,edomain=Acld,hostname=web.com,information="+|acld|DEBUG|MINOR|ACLD|SERVER=DNS unable to resolve 57.220.179.124: Unknown resolver error"

Within my transforms.conf i created a stanza to send the data to null queue:

[setnullSidewinderFirewall]
REGEX= type=t_debug
DEST_KEY = queue
FORMAT = nullQueue

Within my props.conf:

[SidewinderFirewall]
TRANSFORMS-null=setnullSidewinderFirewall

Thank you guys

Tags (1)
0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

The syntax looks basically correct, I'm wondering if the Regex isn't working correctly.

What happens when you set REGEX = t.debug ?

Also, I believe this requires a restart to take effect.

Ref:
http://docs.splunk.com/Documentation/Splunk/5.0/Deploy/Routeandfilterdatad#Filter_event_data_and_sen...

0 Karma

Michael_Schyma1
Contributor

I have restarted splunk, and when i make that correction or change to the regex, it still does not stop the events from coming through.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...