topic Re: How to filter Windows event logs from a Universal Forwarder in Getting Data In

How to filter Windows event logs from a Universal Forwarder

mokeefe — Thu, 02 May 2013 17:28:01 GMT

Using 5.0.2. I am receiving Windows Event Logs at the Indexer from Universal Forwarders on Windows servers. I want to filter out or send to a null queue uninteresting Windows events, so I only see Error, Warning and Critical events.

I know this needs to be in the props.conf and transforms.conf but can't get it to work.

Re: How to filter Windows event logs from a Universal Forwarder

Ayn — Thu, 02 May 2013 17:31:56 GMT

You cannot filter events on a Universal Forwarder. Event filtering can only occur on Splunk instances that perform parsing, which Universal Forwarder doesn't (and can't) do. You need to either setup filtering on the indexer, or switch to a heavy forwarder instead of a Universal Forwarder.

Re: How to filter Windows event logs from a Universal Forwarder

mokeefe — Thu, 02 May 2013 17:33:58 GMT

Yes, I know I can't do it at the UF, but I want to drop the events on the Indexer before they get indexed.

Thanks

Re: How to filter Windows event logs from a Universal Forwarder

mokeefe — Thu, 02 May 2013 17:34:22 GMT

Yes, I know I can't do it at the UF, but I want to drop the events on the Indexer before they get indexed.

Thanks

Re: How to filter Windows event logs from a Universal Forwarder

Ayn — Thu, 02 May 2013 17:37:57 GMT

Your question title announces the question is regarding filtering the events on a UF, so...

If you want help with the specific details you need to provide us with more information than that it "didn't work" - it's impossible to know exactly what you tried and what the exact result was. General info on event filtering is available here: http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Routeandfilterdatad#Keep_specific_events_and_discard_the_rest

Re: How to filter Windows event logs from a Universal Forwarder

Lowell — Fri, 31 Oct 2014 18:03:09 GMT

Check out new Windows Event Log capabilities in Splunk 6.1:

http://blogs.splunk.com/2014/05/23/controlling-4662-messages-in-the-windows-security-event-log/