I have scoured the 'Net, Splunk docs and the Answers and found lots of good information on setting up my indexer filtering to reduce the noise coming from my firewall syslog UDP feed. I feel like I'm really close, because now there is nothing coming through. What I WANT to see are only messages that contain "TCP access denied". I can apply a piped REGEX statement on the search and it works, but I don't seem to have props and transforms files set up quite right yet.
This works in search: source=firewall | regex _raw="TCP access denied"
Props.conf:
[source::firewall]
TRANSFORMS-set= setnull,setparsing
Transforms.conf:
[setnull]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue
[setparsing]
REGEX _raw="TCP access denied"
DEST_KEY = queue
FORMAT = indexQueue
Any additional insight would be welcome!
... View more