https://community.splunk.com/t5/Getting-Data-In/How-do-I-get-a-Splunk-universal-forwarder-to-send-explicit-Event/m-p/400668#M71349 <P>Hello,</P> <P>I'm interested in installing universal forwarders (UF) on machines to ingest local security event logs into Splunk. However, I don't want every single security event log sent from the UFs to the heavy forwarder. </P> <P>This leads to two questions: <BR /> 1. Am I able to specify exactly which Event log IDs to send? <BR /> 2. In addition to specifying Event Log IDs, can I get more granular and, for instance, send only Event ID 4732 logs (a member was added to a security-enabled group) but specify ONLY to send if it matches additional criteria — for members added to particular groups such as the local administrators group?</P> Mon, 18 Feb 2019 18:04:39 GMT johann2017 2019-02-18T18:04:39Z https://community.splunk.com/t5/Getting-Data-In/How-do-I-get-a-Splunk-universal-forwarder-to-send-explicit-Event/m-p/400668#M71349 <P>Hello,</P> <P>I'm interested in installing universal forwarders (UF) on machines to ingest local security event logs into Splunk. However, I don't want every single security event log sent from the UFs to the heavy forwarder. </P> <P>This leads to two questions: <BR /> 1. Am I able to specify exactly which Event log IDs to send? <BR /> 2. In addition to specifying Event Log IDs, can I get more granular and, for instance, send only Event ID 4732 logs (a member was added to a security-enabled group) but specify ONLY to send if it matches additional criteria — for members added to particular groups such as the local administrators group?</P> Mon, 18 Feb 2019 18:04:39 GMT https://community.splunk.com/t5/Getting-Data-In/How-do-I-get-a-Splunk-universal-forwarder-to-send-explicit-Event/m-p/400668#M71349 johann2017 2019-02-18T18:04:39Z https://community.splunk.com/t5/Getting-Data-In/How-do-I-get-a-Splunk-universal-forwarder-to-send-explicit-Event/m-p/400669#M71350 <P>Hi @johann2017 </P> <P>Yes Its definitely possible to filter by IDs. I would recommend you have a quick read of this PDF from the experts at Aplura: <BR /> <A href="https://www.aplura.com/docs/SplunkWindowsEventLogs.pdf">https://www.aplura.com/docs/SplunkWindowsEventLogs.pdf</A></P> <P>It has some very good links to blacklists that you can use to filter the events and reduce your ingest.</P> <P>All the best.</P> Mon, 18 Feb 2019 19:34:58 GMT https://community.splunk.com/t5/Getting-Data-In/How-do-I-get-a-Splunk-universal-forwarder-to-send-explicit-Event/m-p/400669#M71350 chrisyounger 2019-02-18T19:34:58Z https://community.splunk.com/t5/Getting-Data-In/How-do-I-get-a-Splunk-universal-forwarder-to-send-explicit-Event/m-p/400670#M71351 <P>Thanks I think that will get me kickstarted!</P> Tue, 19 Feb 2019 00:14:32 GMT https://community.splunk.com/t5/Getting-Data-In/How-do-I-get-a-Splunk-universal-forwarder-to-send-explicit-Event/m-p/400670#M71351 johann2017 2019-02-19T00:14:32Z