topic Re: Filtering Windows event logs in Getting Data In

Filtering Windows event logs

splunker30039 — Fri, 19 Aug 2011 04:18:50 GMT

I am not able to only forward certain interesting Windows events and ignore the rest. Running 4.2.x on both forwarder and indexer/receiver.

It ignores my restrictions and sends all Windows logs, as if props/transforms in local\ does not get acknowledged..

props:

[source::WinEventLog...]
TRANSFORMS-wmi = events-filter, events-null


[source::WinEventLog...]
TRANSFORMS-wmi = events-filter, events-null

transforms:

[events-null]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue

[events-filter]
REGEX=(?msi)^EventCode=(4625|4624|7036|1102|1033)
DEST_KEY = queue
FORMAT = indexQueue

Tried both [source::WinEventLog...] and [WMI:WinEventLog...], doesnt make a difference.

Driving me crazy, please assist.

Re: Filtering Windows event logs

lguinn2 — Fri, 19 Aug 2011 05:12:45 GMT

I don't think you want to use the ... wildcard for Windows events logs sources. I'm not a Windows expert, but I suggest that you try

[source::WinEventLog*]

Have you tried selecting by sourcetype instead of source?

Re: Filtering Windows event logs

splunker30039 — Fri, 19 Aug 2011 14:58:05 GMT

Have to admit that I am slightly confused about the WMI VS source VS sourcetype, especially the Windows/Splunk changes since 4.2 etc. Is anyone else forwarding Windows logs and filtering on 4.2.x Splunk?

Re: Filtering Windows event logs

ftk — Sat, 20 Aug 2011 03:03:34 GMT

In your props.conf, use [WinEventLog:Security], skipping the source:: part, as you actually want to use a sourcetype definition. You should be able to use [WinEventLog:*] to apply this to all windows event logs, but I haven't tried doing this before, so I am 100% not sure.

Re: Filtering Windows event logs

splunker30039 — Sat, 20 Aug 2011 22:33:46 GMT

Working now.



props.conf:

[WinEventLog:Security]
TRANSFORMS-security= events-null, events-null3, events-filter

[WinEventLog:System]
TRANSFORMS-system= events-null, events-filter

[WinEventLog:Application]
TRANSFORMS-application= events-null, events-filter

transforms.conf:
[events-null]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue

[events-null3]
REGEX=Logon Type=\s*(3)\D
DEST_KEY = queue
FORMAT = nullQueue

[events-filter]
REGEX=(?msi)^EventCode=(5157|4625|4624|7036|1102|1033)\D
DEST_KEY = queue
FORMAT = indexQueue

Key issues:

make sure null filter is before any other event filters
make sure it is on splunk 4.2+. If you have other apps installed, their config files may conflict
Windows splunk seems to be pretty shaky, lots of bugs, bugfixes. I am on 4.2.2, working fine.

Re: Filtering Windows event logs

splunker30039 — Sat, 20 Aug 2011 22:40:48 GMT

BTW, the logon type 3 null filter filters out automated logins, something that clogs up logs and I did not care about. The event IDs are for successful logins/failed logins, application installs and service restarts. I am using one filter for all three facilities, working fine.

Re: Filtering Windows event logs

splunker30039 — Sat, 20 Aug 2011 22:42:56 GMT

BTW, WinEventLog:* did not work. Splunk expects the Security/Application/System facility keywords there.

Re: Filtering Windows event logs

mayler — Tue, 24 Apr 2012 23:49:33 GMT

I'm having a similar issue. How does splunk classify these logs as WinEvenLog? My previous, working, installation had

props.conf

[default]

TRANSFORMS-wmi=wminull

transforms.conf

[wminull]

REGEX=(?msi)^EventCode=(4768|4776|4769|4932|4933|5152|5158|4634|4672|5156|4662|4624|7036|5145|5140)\D
DEST_KEY=queue
FORMAT=nullQueue

Re: Filtering Windows event logs

mayler — Tue, 24 Apr 2012 23:50:00 GMT

I'm having a similar issue. How does splunk classify these logs as WinEvenLog? My previous, working, installation had

props.conf

[default]

TRANSFORMS-wmi=wminull

transforms.conf

[wminull]

REGEX=(?msi)^EventCode=(4768|4776|4769|4932|4933|5152|5158|4634|4672|5156|4662|4624|7036|5145|5140)D DEST_KEY=queue FORMAT=nullQueue

Re: Filtering Windows event logs

fabiocaldas — Fri, 16 Aug 2013 17:07:27 GMT

It worked perfect when I set those values on HeavyForwarder configurations.

Re: Filtering Windows event logs

mcronkrite — Mon, 28 Sep 2020 17:43:36 GMT

On the latest Splunk versions 6.0+ you will want to have the Splunk_TA_Windows installed on the Forwarder and Indexer/Search Head tiers. This TA will extract the Event Code fields for you from Windows Event Logs.

Don't forget to also turn on auditing and domain policies for the specific events you want to collect.

Check out the Splunk Blog post about Windows Event Filtering
http://blogs.splunk.com/2013/10/14/windows-event-logs-in-splunk-6/