topic Multiple WMI sources in PROPS.conf in Getting Data In

Multiple WMI sources in PROPS.conf

philliphyatt — Wed, 12 Jun 2013 15:49:41 GMT

Complete newb here, any help appreciated!

props.conf
[WMI:WinEventLog:Security]
TRANSFORMS-set= setnulla,parse2003secevents,parse2008secevents

[WMI:WinEventLog:System]
TRANSFORMS-set= setnullb,parse2003sysevents,parse2008sysevents

Transforms.conf
[setnulla]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue

[parse2003secevents]
REGEX =(?msi)^EventCode=(xxx|xxx)\b
DEST_KEY = queue
FORMAT = indexQueue

[parse2008secevents]
REGEX =(?msi)^EventCode=(xxxx|xxxx)\b
DEST_KEY = queue
FORMAT = indexQueue

[setnullb]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue

[parse2003sysevents]
REGEX =(?msi)^EventCode=(xxx|xxx)\b
DEST_KEY = queue
FORMAT = indexQueue

[parse2008sysevents]
REGEX =(?msi)^EventCode=(xxxx|xxxx)\b
DEST_KEY = queue
FORMAT = indexQueue

Re: Multiple WMI sources in PROPS.conf

tgow — Wed, 12 Jun 2013 16:11:14 GMT

As a general rule it is better to configure Splunk to filter out what you don't want and leave the rest to be indexed. The first issue I see is the the "REGEX = ." which means to send all of the data into the null queue. This is a great method to test if the transforms is working but not a good idea. So I am assuming that you want to only filter certain EventCodes from being indexed.

props.conf
[WMI:WinEventLog:Security]
TRANSFORMS-set= setnulla,

transforms.conf
REGEX =(?msi)^EventCode=(4756|4775)
DEST_KEY = queue
FORMAT = nullQueue

This props/transforms combination will not index any EventCode of 4756 or 4775 but all other events will be indexed.

Re: Multiple WMI sources in PROPS.conf

philliphyatt — Wed, 12 Jun 2013 16:47:51 GMT

Thanks for the response but my intent is to drop everything but the event codes in the [parse] statements. Sorry I guess I should have clarified.