topic Re: WinEventLog:Security filtering does not work in Getting Data In

WinEventLog:Security filtering does not work

arapozo — Sat, 26 Mar 2011 20:10:48 GMT

Even after reading the documentation and a lot of posts here on answers, I just can't get filtering to work. I've recently installed two VM to test it out.

One indexer server and one universal forwarder. The configuration is being done in the Indexer since universal forwarder according to the docs doesn't do parsing.

REGEX is set to "." to test if the filtering is working.

SPLUNK\etc\system\local\props.conf
[WinEventLog:Security]
TRANSFORMS-setnull = setnull

SPLUNK\etc\system\local\transforms.conf
[setnull]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue

Isn't this configuration supposed to filter everything from WinEventLog:Security?
I get all the logs anyways.

Additional information that may be related:

http://answers.splunk.com/questions/13196/universal-forwarder-sending-cooked-data-to-indexer

Re: WinEventLog:Security filtering does not work

the_wolverine — Sun, 27 Mar 2011 03:38:01 GMT

http://answers.splunk.com/questions/3239/try-to-route-certain-wmi-events-to-nullqueue

Re: WinEventLog:Security filtering does not work

arapozo — Sun, 27 Mar 2011 07:20:04 GMT

I'm not using WMI to collect events, the source is always a universal forwarder.

Re: WinEventLog:Security filtering does not work

jbsplunk — Tue, 29 Mar 2011 05:13:48 GMT

What does the input on the Universal Forwarder use to get data from the event logs?

Re: WinEventLog:Security filtering does not work

arapozo — Tue, 29 Mar 2011 06:08:45 GMT

I just installed the forwarder and only selected the security log in the wizard, nothing else.

Re: WinEventLog:Security filtering does not work

Ellen — Sat, 09 Apr 2011 03:03:21 GMT

You have run into a known issue (SPL-38443) with the 4.2 Lightweight and Universal Forwarder.

The Windows 4.2 lightweight and universal forwarder parses WinEventLog datastreams on the forwarder, preventing all parsing control on the indexer.

The symptoms of this are: no filtering nor routing to the nullqueue based on props and transforms. WinEventLog data is bypassing props.conf and transforms.conf on the indexer.

The workaround would be to use a 4.2 full/regular forwarder or 4.1.x lightweight forwarder but this will be fixed for 4.2.1

http://www.splunk.com/base/Documentation/latest/ReleaseNotes/Knownissues

Re: WinEventLog:Security filtering does not work

MuS — Wed, 08 Jun 2011 19:26:54 GMT

Hi Ellen,
is this really solved in 4.2.1 universal forwarder? I just ran into exactly this problem, that I was unable to redirect WinEventLog events no matter what transform I used. Only way to get them into different indexes was to set the index in inputs.conf on the 4.2.1 universal forwarder.

best regards, MuS