Getting Data In

How to setup a filter to drop specific events on the heavy forwarder?

arlombar1
Explorer

Hello, I'm trying to setup a filter to drop specific events that contain an event name from AWS. I've read through the splunk docs and the process seems straight forward:

On the HF where I am getting my input for AWS logs I've made the updates to the props.conf and transforms.conf file like so:

props.conf

[aws]
TRANSFORMS-set_null = to_null

transforms.conf

[to_null]
REGEX = eventname
DEST_KEY = queue
FORMAT = nullQueue

I did not list my regex in this example as I don't feel this is the issue (I've verified the expression works outside of splunk against the raw events).

Is there something else I am missing here? As a pre-caution ive also added the above files to my indexers, but am still seeing the events in question.

0 Karma

woodcock
Esteemed Legend

You need to restart all Splunk instances on the nodes that run the first full instance of Splunk handling the data (your HFs). Old events will stay broken but new events will be correct.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

This configuration should be in first SplunkEnterprise instance that comes in your data flow, which I assume is your heavy forwarder. Did you restart Splunk on your HF after making this configuration change? Also, make sure the sourcetype name is correct.

0 Karma

arlombar1
Explorer

Looks to be working now, I must of forgot to restart splunkd on the HF. Do I need to have the same props/transforms on the indexers as well? Just trying to clean up where I can.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

No.. it's only required on the instance where events go through parsingQueue (which is HF in your case).

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...