topic Re: nullQueue for Windows event codes not working in Getting Data In

nullQueue for Windows event codes not working

ebailey — Thu, 11 Jun 2015 14:45:47 GMT

Hello,

I am trying to setup a nullQueue for Windows security events we do not care to index into Splunk and my configuration is not working. I am using the below on the Indexer and restarted Splunk. I do not see any errors and I am not sure how else to troubleshoot the issue. The sourcetype in the props matches the sourcetype of the data. Any feedback is most appreciated.

props.conf

[WinEventLog:Security]
TRANSFORMS-WinEvents=eliminate-eventcodes

transforms.conf

[eliminate-eventcodes]
REGEX = EventCode=(5156|4656|33205|5158|577|578|5157|5145|4769|4768|5145|4634)
DEST_KEY = queue
FORMAT = nullQueue

Re: nullQueue for Windows event codes not working

masonmorales — Thu, 11 Jun 2015 22:24:45 GMT

Try...

props.conf

[WinEventLog:Security]
TRANSFORMS-DiscardWinEvents = eliminate-eventcodes

transforms.conf

[eliminate-eventcodes]
REGEX = (?m)^EventCode=(5156|4656|33205|5158|577|578|5157|5145|4769|4768|5145|4634)
DEST_KEY = queue
FORMAT = nullQueue

You'll need to restart your indexer again after making the change.

Re: nullQueue for Windows event codes not working

ebailey — Fri, 12 Jun 2015 14:12:38 GMT

No joy - I made the change and then restarted splunkd. The events are still being indexed. I have other data getting dumped to nullqeueu so this not working is confusing.

Re: nullQueue for Windows event codes not working

masonmorales — Fri, 12 Jun 2015 14:52:29 GMT

Could email me a ./splunk diag from your forwarder and your indexer? (See e-mail address in my portfolio)

Re: nullQueue for Windows event codes not working

yannK — Fri, 12 Jun 2015 23:39:02 GMT

if you are using an Universal/Lightweight forwarder, then the nullQueue props/transforms have to be on the indexers.
But if you re using heavy forwarders (HF), you need to put the props/transforms have to to be on the HF.

otherwise since splunk 5, you can filter evencodes directly on the forwarders in the inputs.con (look for blacklist under WinEventcode)

Re: nullQueue for Windows event codes not working

ebailey — Mon, 29 Jun 2015 15:35:28 GMT

the settings are on the indexers - I am working with support on the issue - Thanks for the suggestions