topic Re: How do you filter windows event log? in Getting Data In

How do you filter windows event log?

chengyu — Fri, 24 Oct 2014 04:01:01 GMT

Hi, when I do the filtering windows log, I use the main program 6.1.4 then changed forwarder license, so Windows AD (main program changed forwarder license ) >> forwarder(main program changed forwarder license ) >> splunk index is my architecture.
I hope drop eventcode=540 and 538, I have a reference to other people's actions, but unsuccessful.

transforms.conf

props.conf
[WinEventLog:Security] * Or [WMI:WinEventLog:Security] Or [wmi:WinEventLog:Security] Or [source::WinEventLog:Security]
TRANSFORMS-set = delete

[delete]
REGEX = (?msi)^EventCode=540 * Or REGEX=(?m)^EventCode=(540|538) Or REGEX=(?msi)^EventCode=(540|538)
DEST_KEY = queue
FORMAT = nullQueue

Re: How do you filter windows event log?

jrodman — Fri, 24 Oct 2014 04:59:27 GMT

I find this difficult to understand.

Do you mean that you have a forwarder sending to an indexer, or that you have a forwarder running with AD sending to another forwarder, that sends to an indexer?

Can you please show a specific case of your props.conf? Is the transforms.conf empty?

On which system are you setting up these configurations? Are the systems Universal Forwarders or forwarders configured as Splunk Light Forwarders?

It might be easier to use the WinEventLog filtering that is built-in to the input, for example:

[WinEventLog://Security]
blacklist= 540,538

Re: How do you filter windows event log?

splunker12er — Fri, 24 Oct 2014 09:51:51 GMT

Set the below configs at indexer and give a try..

props.conf

[source::*:Security]
TRANSFORMS-set=setnull,setparsing

transforms.conf

[setparsing]
REGEX = .
DEST_KEY = queue
FORMAT =  indexQueue

[setnull]
REGEX =(?m)^EventCode=(540|538)
DEST_KEY = queue
FORMAT = nullQueue

Re: How do you filter windows event log?

jrodman — Fri, 24 Oct 2014 10:13:48 GMT

Not sure why you'd use [source::*:Security] If that works, then [source::WinEventLog:Security] would also work, and be a fair amount clearer, I think. I'd use the sourcetype myself.

This should indeed work, however, if there are no heavy forwarders along the way.

Filtering at the input level is more efficient, but it doesn't work with old versions of forwarders, so there's the tradeoff.