topic Re: Why is the Index Filter is not working? in Getting Data In

Why is the Index Filter is not working?

ntripp_element — Fri, 23 Feb 2018 17:32:34 GMT

I have a filter built from: http://docs.splunk.com/Documentation/Splunk/7.0.2/Forwarding/Routeandfilterdatad and https://www.splunk.com/blog/2012/09/21/the-splunk-app-for-active-directory-and-how-i-tamed-the-security-log.html

transforms.conf
[dumpFirewallEvents]
REGEX=(?m)EventCode=(5156|5157)
DEST_KEY = queue
FORMAT=nullQueue

props.conf
[source::wineventlog:security] TRANSFORMS-firewall = dumpFirewallEvents

I'm stilling seeing the events 5156 in splunk and it's flooding the index quota

Re: Why is the Index Filter is not working?

somesoni2 — Fri, 23 Feb 2018 19:04:23 GMT

If you're using Splunk 6 or above at your forwarder level, you can/should do filter of Windows Event logs at forwarder level using blacklist attribute in the monitoring stanza. See this

http://docs.splunk.com/Documentation/Splunk/7.0.2/Data/MonitorWindowseventlogdata#Create_advanced_filters_with_.27whitelist.27_and_.27blacklist.27

Re: Why is the Index Filter is not working?

ntripp_element — Fri, 23 Feb 2018 21:05:13 GMT

I tried that too as below:

[default]
host =

[script://$SPLUNK_HOME\bin\scripts\splunk-wmi.path]
disabled = 0

[WinEventLog://Security]
disabled = 0
start_from = oldest
blacklist = 5156-5157

Also not working

Re: Why is the Index Filter is not working?

somesoni2 — Fri, 23 Feb 2018 21:15:15 GMT

So you're adding above inputs.conf entry in the Windows server where you're collecting Windows Event logs from? Did you restart Splunk service after making the change?

Re: Why is the Index Filter is not working?

ntripp_element — Fri, 23 Feb 2018 21:21:30 GMT

I'm using the universal forwarder to the splunk indexer. I placed those settings into inputs.conf on the indexer and restarted the service.

Re: Why is the Index Filter is not working?

gcusello — Sat, 24 Feb 2018 18:09:12 GMT

Hi ntripp_element,
at a first sight, I see an error in your regex: = is a special char that you must escape with backslash "\"

REGEX=(?m)EventCode\=5156|5157

Anyway I usually prefer to use two transforms:
in props.conf

[WinEventLog:Security]
TRANSFORMS-set= setparsing,setnull

in transforms.conf

[setnull]
REGEX = (?m)EventCode\=(5156|5157)
DEST_KEY = queue
FORMAT = nullQueue
[setparsing]
REGEX = .
DEST_KEY = queue
FORMAT = indexQueue

Bye.
Giuseppe