topic discard not needed events in Getting Data In

discard not needed events

Clovens — Tue, 02 Jul 2013 19:39:36 GMT

Hi,
I am new to splunk, I only want to forward specific events to splunk (for example: failures)and discard the rest.In the props.conf file
I added these lines below
[WMI:WinEventLog:Security]
TRANSFORMS-wmi=wminull

and in the transforms.conf file, I added those lines
[wminull]
REGEX=(?m)^Keywords = Audit Success
DEST_KEY=queue
FORMAT=nullQueue

the indexer is still receiving the Audit Success logs, would you please let me know what I am doing wrong?

thanks,.

Re: discard not needed events

Ayn — Tue, 02 Jul 2013 20:25:06 GMT

Two possible causes to this:
- You're trying to do this on a Universal Forwarder. These will not filter data - it has to be done on the indexer.
- Your regex isn't matching properly.

Re: discard not needed events

mloven_splunk — Wed, 03 Jul 2013 02:59:20 GMT

Clovens,

Another possibility is that that beginning of line character may not actually be there. Try it with just Audit Success and see what happens.

Also, the things that Ayn mentioned. Make sure those are correct first.

Re: discard not needed events

Clovens — Mon, 08 Jul 2013 17:01:11 GMT

I made the changes but the indexer is still collecting the data,
I even tried using the eventype but that didn't work either.

[EventType]
REGEX=(?m)Type=Information
DEST_KEY=queue
FORMAT=nullQueue

below is one of the events that I want to discard

LogName=Security
SourceName=Microsoft Windows securityauditing.
EventCode=5156
EventType=0
Type=Information
ComputerName=Computer.domain.inc
TaskCategory=Filtering Platform Connection
OpCode=Info
RecordNumber=711139664
Keywords=Audit Success
Message=The Windows Filtering Platform has allowed a connection.

would you please take a look, thanks.