https://community.splunk.com/t5/Getting-Data-In/How-do-you-filter-out-an-event-based-on-an-account-name/m-p/398265#M71005 <P>Thanks for the reply.<BR /> based on the docs, this means that i need to add this configuration for props.conf and transforms.conf, under $SPLUNK_HOME/etc/system/local/.<BR /> Im based on the "Filter WMI and Event Log events" on the doc.<BR /> Is that correct?</P> Tue, 26 Feb 2019 14:08:10 GMT alexandrosd 2019-02-26T14:08:10Z https://community.splunk.com/t5/Getting-Data-In/How-do-you-filter-out-an-event-based-on-an-account-name/m-p/398263#M71003 <P>Hello,</P> <P>I am trying to exclude specific event logs from a Windows system being forwarded and indexed to Splunk.</P> <P>What I need to do is to filter out an event based on the content of the event (actually for a specific user called installer).</P> <P>What i did so far is:</P> <P>Under props.conf of universal forwarder ($PROGRAMFILES\SplunkUniversalForwarder\etc\apps\SplunkUniversalForwarder\local\props.conf) I defined the following:</P> <PRE><CODE>[WinEventLog:Security] TRANSFORMS-t1=exclude-installer </CODE></PRE> <P>and under transforms.conf on the same path the following:</P> <PRE><CODE>[exclude-installer] REGEX=(?s)(Account Name:\s\sinstaller) DEST_KEY=queue FORMAT=nullQueue </CODE></PRE> <P>The problem is that this specific configuration does not work. Events are not filtered out...</P> <P>Any suggestions?</P> <P>Thank you in advance.</P> Tue, 26 Feb 2019 12:08:59 GMT https://community.splunk.com/t5/Getting-Data-In/How-do-you-filter-out-an-event-based-on-an-account-name/m-p/398263#M71003 alexandrosd 2019-02-26T12:08:59Z https://community.splunk.com/t5/Getting-Data-In/How-do-you-filter-out-an-event-based-on-an-account-name/m-p/398264#M71004 <P>Hi alexandrosd ,</P> <P>unfortunately you can not directly filter/route to null queue on your universal forwarder, since the universal forwarder does not parse the events so it's not able to apply props.conf / transforms.conf transformations. </P> <P>Only a heavy-forwarder/indexer is parsing the data and is able to filter the events. </P> <P>Depending on your architecture you would most likely want simply want to move your configuration to your indexer(s) if there is no heavy forwarder inbetween your universal forwarder and indexer tier. </P> <P>More to read: </P> <P><A href="https://docs.splunk.com/Documentation/Splunk/7.2.4/Forwarding/Routeandfilterdatad">https://docs.splunk.com/Documentation/Splunk/7.2.4/Forwarding/Routeandfilterdatad</A></P> <P><A href="https://wiki.splunk.com/Community:HowIndexingWorks">https://wiki.splunk.com/Community:HowIndexingWorks</A></P> <P><STRONG>Edit</STRONG>: <BR /> Since you are dealing with Windows Event Logs you can apply a so called backlist in your inputs.conf on your Universal Forwarder: </P> <P>Something like </P> <PRE><CODE>[WinEventLog://Security] ... blacklist1 = EventCode="your eventcode" Account_Name="installer" ... </CODE></PRE> <P>Search for "blacklist" here: <A href="https://docs.splunk.com/Documentation/Splunk/7.2.4/Data/MonitorWindowseventlogdata">https://docs.splunk.com/Documentation/Splunk/7.2.4/Data/MonitorWindowseventlogdata</A></P> <P>Sincerely, <BR /> hgrow</P> Tue, 26 Feb 2019 14:00:18 GMT https://community.splunk.com/t5/Getting-Data-In/How-do-you-filter-out-an-event-based-on-an-account-name/m-p/398264#M71004 hgrow 2019-02-26T14:00:18Z https://community.splunk.com/t5/Getting-Data-In/How-do-you-filter-out-an-event-based-on-an-account-name/m-p/398265#M71005 <P>Thanks for the reply.<BR /> based on the docs, this means that i need to add this configuration for props.conf and transforms.conf, under $SPLUNK_HOME/etc/system/local/.<BR /> Im based on the "Filter WMI and Event Log events" on the doc.<BR /> Is that correct?</P> Tue, 26 Feb 2019 14:08:10 GMT https://community.splunk.com/t5/Getting-Data-In/How-do-you-filter-out-an-event-based-on-an-account-name/m-p/398265#M71005 alexandrosd 2019-02-26T14:08:10Z https://community.splunk.com/t5/Getting-Data-In/How-do-you-filter-out-an-event-based-on-an-account-name/m-p/398266#M71006 <P>Hello hgrow,<BR /> seems that the config on the indexer works perfect for me.<BR /> Changes made under $SPLUNK_HOME/etc/system/local/ and restarted splunk and voila.</P> <P>Thank you.</P> Tue, 26 Feb 2019 14:58:58 GMT https://community.splunk.com/t5/Getting-Data-In/How-do-you-filter-out-an-event-based-on-an-account-name/m-p/398266#M71006 alexandrosd 2019-02-26T14:58:58Z