topic Re: How to handle Windows 2008 event log descriptive text with a universal forwarder in Getting Data In

How to handle Windows 2008 event log descriptive text with a universal forwarder

gpullis — Mon, 09 May 2011 18:08:48 GMT

The crazily verbose descriptive text that's appended to the end of many Windows Server 2008 events has been covered in Splunk Answer Disabling or removing extra description text in Windows 2008 event logs?, with an excellent answer by jervin involving using SEDCMD in props.conf to trim the description off.

The problem is, per Configuration parameters and the data pipeline, a universal forwarder can't do a SEDCMD. It seems to me like you couldn't use a universal forwarder on a Windows 2008 server without absolutely murdering your Splunk license with all that descriptive text.

Can anyone think of a way around this problem?

Re: How to handle Windows 2008 event log descriptive text with a universal forwarder

jbsplunk — Mon, 09 May 2011 18:53:38 GMT

You could implement the configuration where the data is being parsed, most likely the indexer, and it would also alter the data in the same way.

Re: How to handle Windows 2008 event log descriptive text with a universal forwarder

gpullis — Mon, 09 May 2011 18:55:27 GMT

Correct, but then doesn't the unparsed data as it comes into the indexer count against my license?

Re: How to handle Windows 2008 event log descriptive text with a universal forwarder

gpullis — Mon, 09 May 2011 19:00:31 GMT

Thanks! Also, according to
http://splunk-base.splunk.com/answers/7171/sed-cmd-and-indexing-volume-count/7172

Since parsing happens before indexing, what SEDCMD chops off -- even on the indexer -- is not counted towards the license.

Re: How to handle Windows 2008 event log descriptive text with a universal forwarder

rnagheereddy — Fri, 06 Jan 2012 15:46:51 GMT

Make the forwarder a "Heavy Forwarder" and do the work before the data is sent to the Indexer. The tradeoff is that your forwarder will have higher CPU utilization.

I love the descriptive text when I'm scrolling through an actual event log, but I don't need to index or store ten gazillion copies of MSFT boilerplate in my Splunk db.

I'm literally in the middle of doing this so thanks for your link to the SEDCMD article!

Re: How to handle Windows 2008 event log descriptive text with a universal forwarder

ephemeric — Mon, 23 Jul 2012 15:04:02 GMT

You can also do "sendCookedData = false" on the SUF and then work on the events on the indexer or heavy forwarder.

Re: How to handle Windows 2008 event log descriptive text with a universal forwarder

reedmohn — Thu, 12 Jun 2014 12:37:40 GMT

What is the resource cost of doing this on the indexers? After all, in a Windows heavy environment, some of the events with these descriptions probably make up the bulk of logged security events.

Is there a way of doing it on an intermediary step? Ie. putting an intermediary forwarder between the Windows forwarders and the indexers?