Skip to main content
Lantern Home
 
 
Splunk Lantern

Routing root user events to a special index

  1. Last updated
  2. Save as PDF

 

You have a new Splunk Edge Processor installed and ready to be configured. You can now start creating pipelines, which will allow Splunk Edge Processor to process data. Your security team has asked you to filter any events relating to the “root” user in your Linux authentication data and send them to an index they’ve created for you called admin.

Solution 

To meet this request, you need to create a pipeline to filter and route the data.

Applying masking, filtering, and transforming rules to your data can impact downstream processing and analytics that rely on specific fields - such as IP addresses or usernames - to provide insights and intelligence. For example, Splunk Enterprise Security relies on IP addresses and usernames as part of its risk-based alerting (RBA) functionality, meaning that masking either of those fields would limit the ability to detect risk within your security environment. Always check the potential impact of a pipeline before applying it.

  1. Log in to the Edge Processor. 
  2. On the left side menu, click Pipelines.
  3. In the top right corner of the Pipelines page, click Create pipeline and select New pipeline. A pipeline menu appears on the right of the screen.
  4. On this menu on the Actions tab, click the edit icon next to Use data from $source.
  5. Select the correct source type for the data you want to process in this pipeline (example: linux_secure). 
  6. Click the Apply button in the Splunk Edge Processor UI to save the data source.
  7. Click Filter values.
  8. On the Add filter page, define the following:
    1. Field: _raw
    2. Action: Keep
    3. Operator: .* match
    4. Value: root
  9. Deselect Match case to remove case sensitivity and click Apply. A where command is automatically added to your SPL2 statement and should look like this:
    $pipeline =
    | from $source
    | where match(_raw, /root/i)
    | into $destination;
  10. To test your masking rule, click the blue Preview button in the top right corner of the screen. If your pipeline filter is correct you should see some sample events containing ‘root’.
  11. Back on the Actions tab, next to Append data to $destination click the edit button.
  12. Set the destination to the admin index, as requested by your security team. Click Apply to save the destination.
  13. Click Save pipeline in the top right corner of the screen. Give your pipeline a suitable name, such as linux_root_send_to_index_<yourName>.
  14. Click Save to save your pipeline.
  15. To try out the new pipeline, click Pipelines on the top left of the page.
  16. Locate the pipeline you just created, click the three dots next to your new pipeline, and select Apply/remove.
  17. Select the Splunk Edge Processor you created earlier and click Save. You will see a brief message stating that your changes are being saved.
    It may take a few minutes before you see the effects of your pipeline in Splunk Cloud Platform.
  18. To check the status of your Splunk Edge Processor node as the pipeline is being applied, click the pipeline while on the pipelines page. A panel will open up on the right of the page, showing the status of the Splunk Edge Processor instance that this pipeline has been applied to.
  19. Click the arrow next to the instance name to view more information.
  20. After your pipeline has successfully applied the status of your instance should change to healthy. To verify that the instance is indeed healthy, click Edge Processors in the menu on the left of the screen and refresh your web browser until your Splunk Edge Processor displays as healthy.
  21. To check your data, log in to your Splunk Cloud Platform instance and open up the Search & Reporting app.
  22. Run the following search and verify that you now see events containing root in the admin index:
    index=admin root 

Next steps

These additional Splunk resources might help you understand and implement this use case: