Splunk Enterprise Security

How to exclude certain OPSEC LEA events from getting indexed?

echojacques
Builder

Hi everyone,

I have the OPSECLEA TA installed and I'd like to strip out certain events (all destination port 80 (HTTP) events) from getting indexed; however, I'm not sure how to do this. The reason is that we have a heavy volume of allowed HTTP traffic that doesn't need to be indexed and it's saturating our license. I was able to strip out certain Windows WMI events from getting indexed using these instructions:

http://answers.splunk.com/answers/24000/how-do-i-exclude-some-windows-events-from-being-indexed

... but I haven't found a similar set of instructions for OPSECLEA.

Does anyone have any guidance for this? I'm very new to Splunk (enterprise license) and I'm not sure which transforms.conf or props.conf file to modify in order to do this.

Thanks

0 Karma
1 Solution

jcoates_splunk
Splunk Employee
Splunk Employee

Hi, this might be a better source: http://answers.splunk.com/answers/76456/discarding-specific-event-and-keeping-the-rest

In props you want to call out a transforms stanza.

In that transforms stanza you want to define a regex and send matches to nullqueue.

View solution in original post

jcoates_splunk
Splunk Employee
Splunk Employee

Hi, this might be a better source: http://answers.splunk.com/answers/76456/discarding-specific-event-and-keeping-the-rest

In props you want to call out a transforms stanza.

In that transforms stanza you want to define a regex and send matches to nullqueue.

Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...