topic Re: Trying to drop Windows Events at the Indexer in Getting Data In

Trying to drop Windows Events at the Indexer

rmcdougal — Mon, 23 Apr 2012 20:58:40 GMT

I am attempting to drop WinEventLog:Security EventCode's at the Indexer and I am not having any success. I have read a few SplunkBase questions concerning this very topic and attempted to follow the instructions with little success. This is what I have so far.

Props.conf

[WinEventLog:Security] TRANSFORMS-set = dropevents

Transforms.conf

[dropevents] REGEX = (?m)^EventCode=(4957|5154|5156|5158) DEST_KEY = queue FORMAT = nullQueue

Any ideas what I am doing wrong here?

Re: Trying to drop Windows Events at the Indexer

Chubbybunny — Mon, 23 Apr 2012 23:06:57 GMT

we do it like this on our bunny farm:

$SPLUNK_HOME/etc/system/local:
Props.conf

 [WinEventLog:Security]
 TRANSFORMS = null, keep

Transforms.conf

[keep]
REGEX = .
DEST_KEY = queue
FORMAT = indexQueue

[null]
REGEX=EventCode=(4957|5154|5156|5158)
DEST_KEY = queue
FORMAT = nullQueue

Re: Trying to drop Windows Events at the Indexer

Chubbybunny — Mon, 23 Apr 2012 23:18:47 GMT

Vote the Chubby bunny up if it helps!

(\__/)
(='.'=)
(")_(")

Re: Trying to drop Windows Events at the Indexer

rmcdougal — Tue, 24 Apr 2012 14:02:31 GMT

I appreciate the help, but for some reason this still isn't working for me. This is what I have on my box currently but is still isn't dropping anything.

props.conf

[WinEventLog:Security]
TRANSFORMS-set= setnull,setparsing

transforms.conf

[setnull] REGEX = EventCode=(4957|5154|5156|5158) DEST_KEY = queue FORMAT = nullQueue

[setparsing]
REGEX = .
DEST_KEY = queue
FORMAT = indexQueue

Here is a sample event

http://i.imgur.com/FmxeK.png

Re: Trying to drop Windows Events at the Indexer

sowings — Tue, 24 Apr 2012 14:38:25 GMT

The location of the props.conf or transforms.conf matters. If this is a Universal Forwarder (UF), the rules which would trigger for placing these events in the nullQueue aren't processed there. You'll need these rules on the indexer(s) instead. By contrast, if the forwarder is "heavy" (i.e. a full Splunk forwarding its log data elsewhere), the props / transforms have to be on that forwarder itself.

Re: Trying to drop Windows Events at the Indexer

rmcdougal — Tue, 24 Apr 2012 14:38:26 GMT

Interestingly enough, even if I do this

props.conf

[WinEventLog:Security] TRANSFORMS = setnull

transforms.conf

[setnull] REGEX = . DEST_KEY = queue FORMAT = nullQueue

It doesn't drop anything. It has to be something with the sourcetype having a colon in it I imagine.