topic Disabling type "Informational" with splunk for windows in Getting Data In

Disabling type "Informational" with splunk for windows

nbennett — Fri, 25 Jun 2010 23:03:35 GMT

I have a linux indexer. I forward with the light forwarder from about 200 windows boxes.

On the indexer I don't want it to index type=informational.

How does one go about that?

Re: Disabling type "Informational" with splunk for windows

Simeon — Fri, 25 Jun 2010 23:32:15 GMT

It sounds like you want to tune the windows inputs for the forwarding system. See the following link for more guidance:

http://www.splunk.com/base/Documentation/latest/Admin/ConsiderationsfordecidinghowtomonitorWindowsdata

Re: Disabling type "Informational" with splunk for windows

ftk — Sat, 26 Jun 2010 00:59:42 GMT

Take a look at routing and filtering: http://www.splunk.com/base/Documentation/latest/admin/Routeandfilterdata

You will need a transforms.conf stanza to define what events to ignore and a props.conf stanza to define which sourcetype to apply it to.

You can ignore data by routing it to the nullQueue. In transforms.conf:

[routeInfoToNull]
REGEX=(?m)^Type=Information
DEST_KEY=queue
FORMAT=nullQueue

This will set up everything that comes in to match that REGEX (in this case Type=Information on a newline) to go to the nullQueue (basically /dev/null).

Now apply this transforms to your event logs as such in props.conf:

[WinEventLog:System]
TRANSFORMS-SystemInfoToNull = routeInfoToNull

Not that if you're pulling via WMI you will have to apply this to the [wmi] sourcetype. If you want to route data from additional event logs just add more stanzas to props.conf.

Re: Disabling type "Informational" with splunk for windows

ftk — Sat, 26 Jun 2010 01:04:07 GMT

An afterthought: There are lots of interesting events logged as informational on Windows that you might want to actually index. Service startup type changes, service start/stop events, Windows update installs come to mind.