Getting Data In

Filter events from UF based on source + sourcetype or host

splunkreal
Motivator

Hello,

is it possible to filter events based on sourcetype + (host OR sourcetype) with props.conf/transforms.conf on indexers?

Filtering data only based on sourcetype or source could be too wide.

Thanks.

* If this helps, please upvote or accept solution 🙂 *
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @realsplunk,
to filter events you have to identify a large information (e.g. sourcetype or host or source), then you have to find a regex to filter logs related to the above information.
You cannot use two of the above infos (e.g. sourcetype+host)
E.g.: sourcetype=WinEventLog:Security and regex = EventCode=1234

in props.conf

[wineventlog:security]
TRANSFORMS-null= setnull

in transforms.conf

[setnull]
REGEX = EventCode\=1234
DEST_KEY = queue
FORMAT = nullQueue

For more infos see at https://docs.splunk.com/Documentation/Splunk/8.0.1/Forwarding/Routeandfilterdatad

Ciao.
Giuseppe

to4kawa
Ultra Champion
0 Karma

splunkreal
Motivator

Thanks, do you have an example based on a string?

* If this helps, please upvote or accept solution 🙂 *
0 Karma

to4kawa
Ultra Champion

No, I don't have. sorry.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...