topic Re: WinEventLog filtering EventCode in Getting Data In

WinEventLog filtering EventCode

joshrabinowitz — Wed, 09 Mar 2011 00:01:07 GMT

I have a Splunk central indexer on rhel5.5 and a forwarder (not LWF) on a Server 2008 VM. Currently I am forwarding all of WinEventLog:Security, and want to not index EventCode=566.

props.conf

[WMI:WinEventLog:Security]
TRANSFORMS-null= setnull

transforms.conf

[setnull]
REGEX ="(?m)^EventCode=566"
DEST_KEY = queue
FORMAT = nullQueue

Currently these files exist in $SPLUNK_HOME/etc/system/local on the indexer, but I am still seeing results for EventCode=566 in search.

What am I doing wrong?

Re: WinEventLog filtering EventCode

gkanapathy — Wed, 09 Mar 2011 01:24:45 GMT

You shouldn't have the double-quotes (") around your REGEX, since they aren't in the data:

REGEX = (?m)^EventCode=566

Re: WinEventLog filtering EventCode

yannK — Wed, 29 Jun 2011 19:45:32 GMT

BEWARE : On recent versions of the windows app, the sourcetype for windowsevents has changed, so should change the props.conf

[wmi] in splunk 4.1
[WMI:WinEventLog:Security] in 4.2

please try then both, or use them both if you have a mix of forwarder's versions to cover them all.

Re: WinEventLog filtering EventCode

yannK — Fri, 25 Oct 2013 23:32:34 GMT

UPDATE splunk 6.*
Since this version you can actually specify a list or range of eventCodes to exclude at the forwarder level, in inputs.conf. It will reduce the volume at the forwarder level and reduce the network load.

see
http://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf

example:

[WinEventLog:Security] disabled = 0 blacklist=566,800-850