topic windows event filter in Getting Data In https://community.splunk.com/t5/Getting-Data-In/windows-event-filter/m-p/52363#M10068 <P><STRONG><EM>In my transforms.conf I have this filter that does not work</EM></STRONG></P> <P>[dropevents]</P> <P>REGEX = (?msi)^host=server1.*^EventCode=4674</P> <P>DEST_KEY = queue</P> <P>FORMAT = nullQueue</P> <P><STRONG><EM>this does work but dropes events for all systems not just the one system</EM></STRONG></P> <P>[dropevents]</P> <P>REGEX = (?msi)^EventCode=4674</P> <P>DEST_KEY = queue</P> <P>FORMAT = nullQueue</P> <P><STRONG><EM>My props.conf looks like this</EM></STRONG></P> <P>[WinEventLog:Security] </P> <P>TRANSFORMS-set=dropevents</P> Tue, 15 May 2012 20:52:02 GMT hartfoml 2012-05-15T20:52:02Z windows event filter https://community.splunk.com/t5/Getting-Data-In/windows-event-filter/m-p/52363#M10068 <P><STRONG><EM>In my transforms.conf I have this filter that does not work</EM></STRONG></P> <P>[dropevents]</P> <P>REGEX = (?msi)^host=server1.*^EventCode=4674</P> <P>DEST_KEY = queue</P> <P>FORMAT = nullQueue</P> <P><STRONG><EM>this does work but dropes events for all systems not just the one system</EM></STRONG></P> <P>[dropevents]</P> <P>REGEX = (?msi)^EventCode=4674</P> <P>DEST_KEY = queue</P> <P>FORMAT = nullQueue</P> <P><STRONG><EM>My props.conf looks like this</EM></STRONG></P> <P>[WinEventLog:Security] </P> <P>TRANSFORMS-set=dropevents</P> Tue, 15 May 2012 20:52:02 GMT https://community.splunk.com/t5/Getting-Data-In/windows-event-filter/m-p/52363#M10068 hartfoml 2012-05-15T20:52:02Z Re: windows event filter https://community.splunk.com/t5/Getting-Data-In/windows-event-filter/m-p/52364#M10069 <P>I found that this works</P> <PRE><CODE>(?msi)^EventCode=4674.*^ComputerName=(system22|system23|system01).*^Keywords=Audit Success.*SeBackupPrivilege </CODE></PRE> <P>thanks to this site <CODE><A href="http://gskinner.com/RegExr/" target="test_blank">http://gskinner.com/RegExr/</A></CODE></P> <P>use this site to evaluate your regex for filters</P> Tue, 15 May 2012 22:01:44 GMT https://community.splunk.com/t5/Getting-Data-In/windows-event-filter/m-p/52364#M10069 hartfoml 2012-05-15T22:01:44Z