https://community.splunk.com/t5/Getting-Data-In/WMI-Event-Filtering-not-working/m-p/23329#M3672 <P>your example seems to be from splunk 4.1.*, the sourcetype changed since.</P> <P>try <BR /> <CODE><BR /> [WinEventLog:Security]<BR /> TRANSFORMS-wmi=wminull-1,wminull-2<BR /> </CODE></P> Mon, 11 Feb 2013 16:07:13 GMT yannK 2013-02-11T16:07:13Z https://community.splunk.com/t5/Getting-Data-In/WMI-Event-Filtering-not-working/m-p/23328#M3671 <P>I'm not sure why, but this WMI filter isn't working. I'm trying to drop Windows Security Log events 4769, etc. before indexing. Any help is appreciated. Thanks!</P> <P>props.conf:<BR /> [WMI:WinEventLog:Security]<BR /> TRANSFORMS-wmi=wminull-1,wminull-2</P> <P>transforms.conf<BR /> [wminull-1]<BR /> REGEX=(?mi)EventCode=(4769|4634|4776|4672|4770)<BR /> DEST_KEY=queue<BR /> FORMAT=nullQueue</P> <P>[wminull-2]<BR /> REGEX=(?mi)Account_Name=(admin1|admin2|admin3)<BR /> DEST_KEY=queue<BR /> FORMAT=nullQueue</P> Mon, 28 Sep 2020 13:15:27 GMT https://community.splunk.com/t5/Getting-Data-In/WMI-Event-Filtering-not-working/m-p/23328#M3671 wburns 2020-09-28T13:15:27Z https://community.splunk.com/t5/Getting-Data-In/WMI-Event-Filtering-not-working/m-p/23329#M3672 <P>your example seems to be from splunk 4.1.*, the sourcetype changed since.</P> <P>try <BR /> <CODE><BR /> [WinEventLog:Security]<BR /> TRANSFORMS-wmi=wminull-1,wminull-2<BR /> </CODE></P> Mon, 11 Feb 2013 16:07:13 GMT https://community.splunk.com/t5/Getting-Data-In/WMI-Event-Filtering-not-working/m-p/23329#M3672 yannK 2013-02-11T16:07:13Z