Getting Data In

Prevent log events with specific text string from indexing

cwwirth
Explorer

I've got a seemingly simple problem that I'm having a bit of difficulty on. I've been tasked with excluding log events containing a specific text string (in this case, an IP address) from being indexed in Splunk. I've done similar with sources such as Windows event logs (using props.conf and transforms.conf to send to nullQueue based on a regex), but the catch this time is that the event could come from any host, and be any sourcetype. Basically, "if any event comes into Splunk with this text string, send it to nullQueue." Any ideas?

0 Karma
1 Solution

Ayn
Legend

Just do as you've done previously, and make use of that you can use the [default] stanza in props.conf to have transforms apply to all events.

View solution in original post

bmacias84
Champion

Hello, You should be able to use the same method using your props.conf and transforms.conf. Except this time you will define a your transfrom under default stanza in your props.conf. The transform should be applied to all stanza in your props.conf.


#props.conf
[default]
TRANSFORMS-remove_events = ipremove

Hope this helps or gets you started. Dont forget to vote up and accept answers.

Cheers

kristian_kolb
Ultra Champion

According to the docs for props.conf, you can set global settings under the stanza called default instead of a source/sourcetype/host.

http://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf

props.conf

[default]
TRANSFORMS-who_did_it = dunno

transforms.conf

[dunno]
REGEX = <insert your ip>
DEST_KEY = queue
FORMAT = nullQueue

I have never done this (and to be honest, it sounds a bit like someone wanting to cover his/her tracks :), but I can't see why it shouldn't work.

/Kristian

Ayn
Legend

Just do as you've done previously, and make use of that you can use the [default] stanza in props.conf to have transforms apply to all events.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...