topic Re: Problem to discard some WMI events in FileServer with heavyfwd in Getting Data In

Problem to discard some WMI events in FileServer with heavyfwd

mgaleti — Sun, 13 Nov 2011 20:58:47 GMT

I installed a Splunk (Heavy Forwarder) in my Windows 2007 Std SP1 FILE SERVER.
Installed, too, Windows APPs.

I configured it to forward to my Splunk Index Server and this FILESERVER is forwarding correctly (I can see SECURITY events in search app of my Splunk Server).

I would like to >NOT< send WMI secutiry events with Event ID 4673 and 4658 and, for this I made:

1) Inside C:\Program Files\Splunk\etc\apps\windows\default\props.conf

I inserted
[WMI:WinEventLog:Security]
TRANSFORMS-wmi=wminull

2) Inside C:\Program Files\Splunk\etc\apps\windows\default\transform.conf

[wminull]
REGEX=(?m)^EventCode=(4673|4658)
DEST_KEY=queue
FORMAT=nullQueue

After this I re-started this FileServer service and tried to check splunk server but this events 4673 and 4658 still being collected from this server.

Is this regex wrong ?
Thanks !!!!!!!

Re: Problem to discard some WMI events in FileServer with heavyfwd

_d_ — Mon, 14 Nov 2011 03:31:50 GMT

The regex seems fine but I would recommend that you do NOT edit anything in the C:\Program Files\Splunk\etc\system\default directory. Instead, try creating a props.conf and a transforms.conf in C:\Program Files\Splunk\etc\system\local and try again. Also, try changing stanza headers as per below to reflect correct sourcetype.

C:\Program Files\Splunk\etc\system\local\props.conf [WinEventLog:Security] TRANSFORMS-wmi=wminull

C:\Program Files\Splunk\etc\system\local\transforms.conf [wminull] REGEX=(?mi)EventCode=(4673|4658) DEST_KEY=queue FORMAT=nullQueue

Notice, that I changed the regex slightly - it should not matter - AND i change the stanza header for the sourcetype in props.conf.

Hope this helps.

> please upvote and accept answer if you find it useful - thanks!

Re: Problem to discard some WMI events in FileServer with heavyfwd

mgaleti — Wed, 16 Nov 2011 13:40:38 GMT

Great !!!! Thanks ! Worked fine,

Re: Problem to discard some WMI events in FileServer with heavyfwd

_d_ — Wed, 16 Nov 2011 13:44:41 GMT

mgaleti, please accept answer and upvote so that other community members can find it useful. Thanks.