topic Re: Discard Windows Events and keep the rest in Getting Data In

Discard Windows Events and keep the rest

apro — Mon, 05 Jul 2010 11:09:27 GMT

Hi,

Had installed splunk on serverA and serverB and configured both as a forwarder to forward wineventlogs to splunk indexer.

I will like to filter out certain events(eg.540) and I tried doing this on the splunk indexer itself:

/opt/splunk/etc/system/local/props.conf [WinEventLog:Security] TRANSFORMS-null = setnull

/opt/splunk/etc/system/local/transforms.conf [setnull] REGEX = (?m)^EventCode=540 DEST_KEY = queue FORMAT = nullQueue

Apparently it still doesn't work after doing a search the events are still shown:
host="serverA" EventCode=540

1) How do I filter out event code 540? Should it be done on the forwarder itself or splunk indexer?

2) How do I filter out event code 540, only on serverA and not serverB?

Thanks.

Re: Discard Windows Events and keep the rest

apro — Mon, 05 Jul 2010 15:42:31 GMT

Not sure if anything yet but tried shifting the configuration to the forwarder itself now as mine seems to be a heavy forwarder.

Found this link to be useful: Where do I configure my Splunk settings?

Seems ok but am monitoring it.If it works, it solves my problem of filtering out event codes on one server but not another as well..

Re: Discard Windows Events and keep the rest

aaronzabell — Tue, 24 Aug 2010 03:50:38 GMT

Did this ever start working for you?

Re: Discard Windows Events and keep the rest

mgh4 — Fri, 12 Jul 2013 12:31:42 GMT

I've had the same problem. I can filter perfmon this way. I have a mix of heavy/universal forwarders and don't want to implement the filter on every windows heavy forwarder individually.