Filter Windows Event Data to different Targets?

rbal_splunk — Sun, 21 Feb 2016 05:57:42 GMT

Question : I would like to ingest windows event data using Splunk Heavy Forwarder and need to filter Windows event logs to Splunk indexer. Basically I want to index Winevent (Application , System and Setup) on indexer 136 , All the other winevent Security log to indexer 133 and only winevent Security for EventCode 4634 and 4672 to Indexer144

What are the options to meet this need?

Re: Filter Windows Event Data to different Targets?

rbal_splunk — Tue, 29 Sep 2020 08:50:49 GMT

My test is based on Splunk Version 6.3.3.

Here are the setting that worked for me.

1)On Heavy Forwarder – set inputs.conf as

[WinEventLog://Application]
checkpointInterval = 5
current_only = 0
disabled = 0
start_from = oldest

[WinEventLog://Security]
checkpointInterval = 5
current_only = 0
_TCP_ROUTING = LI_133
disabled = 0
start_from = oldest

[WinEventLog://Setup]
checkpointInterval = 5
current_only = 0
disabled = 0
start_from = oldest

[WinEventLog://System]
checkpointInterval = 5
current_only = 0
disabled = 0
start_from = oldest

2) Also Heavy Forwarder has props.conf and transforms.conf as

----Props.conf---------
[WinEventLog:Security]
TRANSFORMS-null= InCludeEvents

----transforms.conf-------
[InCludeEvents]
REGEX = EventCode=(4634|4672)
DEST_KEY = _TCP_ROUTING
FORMAT = LI_144

3) Also Heavy Forwarder-outputs.conf has

[tcpout]
indexAndForward = 1
autoLB = true
compressed = false
defaultGroup = LI_136

[tcpout:LI_136]
server = server_136:9997

[tcpout: LI_144]
server = server_136:9997

[tcpout:LI_133]
server = server_133:9997

topic Filter Windows Event Data to different Targets? in Getting Data In

Filter Windows Event Data to different Targets?

Re: Filter Windows Event Data to different Targets?