topic Filtering windows events not successful on splunk forwarder? in Getting Data In

Filtering windows events not successful on splunk forwarder?

remy06 — Fri, 13 Aug 2010 09:55:57 GMT

Hi,

I've installed splunk forwarder(regular) on windows server and trying to filter off certain events when sending to splunk indexer. Here is my sample configuration:

props.conf
[WinEventLog:Security]
TRANSFORMS-null = setnull

transform.conf
[setnull]
REGEX = (?m)^EventCode=(540|673|861)\b
DEST_KEY = queue
FORMAT = nullQueue

Splunk services were stopped while I'm editing the files and enabled after.The configuration was done on the forwarder itself.I did a search where "host=serverA EventCode=540" and I still see the events.

Any idea?

Re: Filtering windows events not successful on splunk forwarder?

hexx — Fri, 13 Aug 2010 13:45:22 GMT

Just making sure : When you say "I still see the events", are you referring to events that were indexed before you made your changes?

Re: Filtering windows events not successful on splunk forwarder?

Jag — Tue, 17 Aug 2010 04:36:16 GMT

Is this LightWeightForwarder(LWF) or a regular forwarder? If this is LightWeightForwarder, this may not work as data is not not parsed into individual events in LWF.

Re: Filtering windows events not successful on splunk forwarder?

remy06 — Tue, 19 Oct 2010 10:31:37 GMT

This is working for me now..although there isn't much difference than the previous but here goes:

[setnull] REGEX = (?msi)^EventCode=(540|673|861)\b DEST_KEY = queue FORMAT = nullQueue

Re: Filtering windows events not successful on splunk forwarder?

remy06 — Tue, 19 Oct 2010 10:32:07 GMT

Am using a regular forwarder

Re: Filtering windows events not successful on splunk forwarder?

remy06 — Tue, 19 Oct 2010 10:32:35 GMT

I monitored the events after ive made the changes and still see them