topic Re: WMI filtering only eventlog from some users in Getting Data In

WMI filtering only eventlog from some users

pmelchiori — Mon, 05 Mar 2012 16:22:05 GMT

I'm looking for a way to filter all the log eventlog from certain user's group (SYSTEM and Administrator), but all my test going bad 😞

(splunk 4.1.6)

prof.conf:

[wmi]
TRANSFORMS-wminull = wmi-null, wmi-parsing

transforms.conf

[wmi-null]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue  

[wmi-parsing]
REGEX = (?m)^User=(SYSTEM|Administrator)
DEST_KEY = queue
FORMAT = nullQueue

Re: WMI filtering only eventlog from some users

MarioM — Mon, 05 Mar 2012 20:52:05 GMT

did you try the followings:

REGEX = (.)

AND/OR

REGEX = (?msi)^User=(SYSTEM|Administrator)

Re: WMI filtering only eventlog from some users

pmelchiori — Tue, 06 Mar 2012 14:28:41 GMT

Yes, it does't filter anything, I can see all the logs in Splunk.

Re: WMI filtering only eventlog from some users

sdwilkerson — Tue, 06 Mar 2012 15:09:26 GMT

pmelchiori,

It looks like you have the syntax mostly right, but you need to check a few things.

Is the sourcetype that you want to drop just "wmi" or is it "wmi:WinEventLog:Security" etc? Make sure this is explicit.

Additionally, your transform will apply to a SOURCE_KEY = _raw unless otherwise stated. Your _raw will probably be equal to the entire event. That would mean that the string "user=XXX" is NOT at the beginning of the event, and therefore you don't want the carat "^" in your regex.

Finally, you have two transforms, that do two different things. The top one has a REGEX = (.).
In Regex, a dot "." means match any single character. So, this will match anything and mark it all to the nullQueue. I am not sure your intention here, but you may want to adjust this or maybe even omit the first transform in lieu of the second.

Check the sourcetype, check your transforms, fix that in props.conf and then remove your carat and see how that goes.

Best,

Sean

Re: WMI filtering only eventlog from some users

pmelchiori — Tue, 06 Mar 2012 17:27:27 GMT

Okay, I've made all the changes but it still archiving any log!

Switching the props.conf in wmi:WinEventLog:Security it stops working totally.

Re: WMI filtering only eventlog from some users

sdwilkerson — Wed, 07 Mar 2012 01:38:58 GMT

See my updated answer above.