topic Re: Transforming Frowarded WinEvents in Getting Data In

Transforming Frowarded WinEvents

jwarfel — Tue, 10 Dec 2013 18:57:10 GMT

Scenario:
Multiple WinHosts forwarding logs to separate Linux indexers using Splunk Forwarders.

Objective:
The ability to transform WinEvents using transforms.conf and props.conf

Situation:
Transforming data from local sources, such as syslog works without error. Transforming the forwarded events is not working. I am wondering if I need to specify the forwarded data in inputs.conf?

Re: Transforming Frowarded WinEvents

kristian_kolb — Tue, 10 Dec 2013 19:27:23 GMT

What parts of the events do you want transform, and why?

In any case, you do know that the props/transforms settings should be configured on the indexer, right?

http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings

Re: Transforming Frowarded WinEvents

jwarfel — Tue, 10 Dec 2013 19:47:33 GMT

Yes, I should have been more specific. I am transforming on the indexer. I want to be able to transform any parts of the events. To send all WinEventLog:Security to the null queue for example.

Re: Transforming Frowarded WinEvents

lukejadamec — Tue, 10 Dec 2013 20:03:25 GMT

What version of splunk are you using?

Re: Transforming Frowarded WinEvents

jwarfel — Tue, 10 Dec 2013 20:06:01 GMT

Version = 5.0.2

Re: Transforming Frowarded WinEvents

kristian_kolb — Tue, 10 Dec 2013 20:41:57 GMT

Well, if you want to be rid of all WinEventLog:Security, it's probably better to not monitor them in the first place. Other than that, it could be done like;

props.conf

[WinEventLog:Security]
TRANSFORMS-blah = discard

transforms.conf

[discard]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue

This is not working for you?

Re: Transforming Frowarded WinEvents

lukejadamec — Tue, 10 Dec 2013 21:00:04 GMT

Here is a good example of filtering security events (in case you want to keep some of them).
Just remember the order is important - send to nullQueue first:

http://answers.splunk.com/answers/29218/filtering-windows-event-logs

Re: Transforming Frowarded WinEvents

jwarfel — Tue, 10 Dec 2013 21:02:46 GMT

No, that is not working for me. I think it has something to do with the events being forwarded.

Re: Transforming Frowarded WinEvents

jwarfel — Tue, 10 Dec 2013 22:20:15 GMT

This is not working either.

Re: Transforming Frowarded WinEvents

lukejadamec — Tue, 10 Dec 2013 22:57:06 GMT

Filtering windows events is a very common practice. It does work - I do it myself.
But, there are a number of things that can go wrong.
What exactly is the sourcetype? Where are you placing the configs, which files, and what are the configs?
Why do you think there is something wrong with the forwarded data - windows security logs are standard, but they can come from at least two different sources.
Did you restart Splunk on the indexer after you made the changes?
Lastly, you do know that these changes will not affect logs already indexed right?