https://community.splunk.com/t5/Getting-Data-In/How-to-configure-Splunk-to-index-only-security-events-from/m-p/147645#M30066 <P>There are many posts for Windows event filtering. Have a look at them.</P> <P><A href="http://answers.splunk.com/answers/29218/filtering-windows-event-logs">http://answers.splunk.com/answers/29218/filtering-windows-event-logs</A></P> <P><A href="http://answers.splunk.com/answers/1888/How-do-I-configure-Splunk-to-filter-out-events-I-don%E2%80%99t-want-to-index%3F">http://answers.splunk.com/answers/1888/How-do-I-configure-Splunk-to-filter-out-events-I-don%E2%80%99t-want-to-index%3F</A></P> Thu, 17 Jul 2014 18:51:27 GMT somesoni2 2014-07-17T18:51:27Z https://community.splunk.com/t5/Getting-Data-In/How-to-configure-Splunk-to-index-only-security-events-from/m-p/147644#M30065 <P>Can Splunk be configured to index only security events (failed logins, authorization changes, etc) from Windows machines, and not performance information?</P> Thu, 17 Jul 2014 18:43:01 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-configure-Splunk-to-index-only-security-events-from/m-p/147644#M30065 pbrown1117 2014-07-17T18:43:01Z https://community.splunk.com/t5/Getting-Data-In/How-to-configure-Splunk-to-index-only-security-events-from/m-p/147645#M30066 <P>There are many posts for Windows event filtering. Have a look at them.</P> <P><A href="http://answers.splunk.com/answers/29218/filtering-windows-event-logs">http://answers.splunk.com/answers/29218/filtering-windows-event-logs</A></P> <P><A href="http://answers.splunk.com/answers/1888/How-do-I-configure-Splunk-to-filter-out-events-I-don%E2%80%99t-want-to-index%3F">http://answers.splunk.com/answers/1888/How-do-I-configure-Splunk-to-filter-out-events-I-don%E2%80%99t-want-to-index%3F</A></P> Thu, 17 Jul 2014 18:51:27 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-configure-Splunk-to-index-only-security-events-from/m-p/147645#M30066 somesoni2 2014-07-17T18:51:27Z https://community.splunk.com/t5/Getting-Data-In/How-to-configure-Splunk-to-index-only-security-events-from/m-p/147646#M30067 <P>Yes, you should use this in you inputs.conf file :</P> <PRE><CODE>[WinEventLog://Security] disabled = 0 </CODE></PRE> <P>We do the exact same thing, furthermore we sort out event number we don't need using event ID exctracted from :<BR /> <A href="http://support.microsoft.com/kb/977519">http://support.microsoft.com/kb/977519</A></P> <P>Here's what our transforms.conf looks like :</P> <PRE><CODE>[grab] REGEX = (?msi).*EventCode=(4624|4634|4625|4740|4767|5143|4670|4670|4663|4670|4670|4660|4663|5143|4657|4720|4722|47239|4724|4738|4725|4726|4738|4727|4731|4728|4732|4729|4733|4730|4734|6144|4674|4674|4674|4608|4609|4610|4611|4612|4614|4616|528|538|540|529|682|531|551|537|539|552|4623|4672|4647|4648|560|562|4656|4658) DEST_KEY = queue FORMAT = indexQueue </CODE></PRE> Thu, 17 Jul 2014 18:54:53 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-configure-Splunk-to-index-only-security-events-from/m-p/147646#M30067 gnoellbn 2014-07-17T18:54:53Z