topic Re: WinEvent Filtering on Heavy Forwarder in Getting Data In

WinEvent Filtering on Heavy Forwarder

stockwel — Tue, 20 Jul 2010 03:36:30 GMT

Hi, Trying to send all eventIDs from WinEventLog:Security to NullQueue with the exception of 592 and 593. Still getting all security events indexed :< props.conf and transforms.conf, located in Splunk\etc\system\local on the forwarder are as follows:

props.conf

[WinEventLog:Security]
TRANSFORMS-set=setnull,setparsing

transforms.conf

[setnull]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue

[setparsing]
REGEX = (?m)^EventCode=(592|593)
DEST_KEY = queue
FORMAT = indexQueue

Thanks, Andie

Re: WinEvent Filtering on Heavy Forwarder

Paolo_Prigione — Tue, 20 Jul 2010 21:01:34 GMT

Hi, a couple things.

1) If you use a LightWeightForwarder, you might have to put those configurations on the indexer too.

2) Windows Security event logs have white spaces before "EventCode", so binding your regex to the start of the line should not work.

REGEX = (?m)EventCode=(592|593)

You could also do the same job with a simpler configuration, though:

props.conf

[WinEventLog:Security]
TRANSFORMS-set=dropevents

transforms.conf

[dropevents]
REGEX = (?m)EventCode=(?!592|593)
DEST_KEY = queue
FORMAT = nullQueue

This regex means "discard everything that has EventCode different from either 592 or 593"

Re: WinEvent Filtering on Heavy Forwarder

Paolo_Prigione — Tue, 20 Jul 2010 21:15:55 GMT

ops, sorry for the inconvenience: point 1) can be discarded as the forwarder type was inherent in the question's title

Re: WinEvent Filtering on Heavy Forwarder

BunnyHop — Thu, 19 Aug 2010 00:51:58 GMT

Try (?msi) instead of just (?m)

Re: WinEvent Filtering on Heavy Forwarder

maverick — Wed, 17 Nov 2010 07:14:17 GMT

Take a look at this answer regarding whitelisting specific event codes to be forwarded.

http://answers.splunk.com/questions/9076/how-to-configure-a-forwarder-to-filter-and-send-only-the-events-i-want