topic Events not being filtered from Universal forwarder in Getting Data In

Events not being filtered from Universal forwarder

mlevenson — Mon, 28 Sep 2020 13:09:08 GMT

Trying to figure out whey I have events showing up that I am not wanting. I only want the events listed below so trying to sort out why.

Transforms.conf
[winevtnull]
REGEX=(?m).
DEST_KEY=queue
FORMAT=nullQueue

[winevtparsing]
REGEX=(?m)^EventCode=(4720|4725|4727|4728|4740|4754|4767|4794|4726|4932|4933|4935|4936|4937|5136|5137|5138|5139|5141|4649|5148|5149|4719|4739|4865|4946|4947|4948|6145|4674|4697|4672|4673)
DEST_KEY=queue
FORMAT=indexQueue

Props.conf

[WinEventLog:Security]
TRANSFORMS-winevt=winevtnull, winevtparsing

Inputs.conf

[default]
host = server

[script://$SPLUNK_HOME\bin\scripts\splunk-perfmon.path]
disabled = 0

[WinEventLog:Application]

[WinEventLog:ForwardedEvents]

[WinEventLog:HardwareEvents]

[WinEventLog:Internet Explorer]

[WinEventLog:Security]
disabled = 0
start_from = newest
current_only = 0

[WinEventLog:Setup]

[WinEventLog:System]

Re: Events not being filtered from Universal forwarder

Ayn — Mon, 21 Jan 2013 18:01:28 GMT

Universal Forwarders do not perform filtering, that has to be done on the indexer (or any other interim "heavy" Splunk instance that does parsing)

EDIT: Adding some info from the docs: http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Routeandfilterdatad

"Important: Only heavy forwarders can route or filter data at the event level. Universal forwarders and light forwarders do not have the ability to inspect individual events, but they can still forward data based on a data stream's host, source, or source type. They can also route based on the data's input stanza, as described here."

Re: Events not being filtered from Universal forwarder

mlevenson — Mon, 21 Jan 2013 20:50:54 GMT

I also found I needed to remove (?m)^ since I was not doing WMI calls for the event gathering.