topic Re: How do you filter windows logs by level? in Getting Data In

How do you filter windows logs by level?

crsupportddc — Wed, 26 Dec 2018 21:30:16 GMT

Is there any way to get only critical and error logs from Windows?

I mean, Windows generates logs using different levels (Critical, Warning, Error, Information...) and I don't want the Information logs on Splunk, so I would like to configure the forwarder to not send them.

Re: How do you filter windows logs by level?

whrg — Wed, 26 Dec 2018 22:43:11 GMT

Hello @crsupportddc,

So I assume the Windows events (which are multiline) contain this line which you want to base your filter on:

Type=Information

Check out this page on how to filter specific events: Discard specific events and keep the rest.

On your heavy forwarder/indexer (whatever system comes after the Universal Forwarder), add the following lines to props.conf:

[WinEventLog:Application]
TRANSFORMS-filter = filter_information
[WinEventLog:Security]
TRANSFORMS-filter = filter_information
[WinEventLog:System]
TRANSFORMS-filter = filter_information

WinEventLog:Application, WinEventLog:Security and WinEventLog:System refer to the sourcetypes.

And add the following lines to transforms.conf:

[filter_information]
REGEX = Type=Information
DEST_KEY = queue
FORMAT = nullQueue

Do not forget to restart Splunk after making these changes.

Re: How do you filter windows logs by level?

crsupportddc — Thu, 27 Dec 2018 19:24:03 GMT

Thank you for the help.
I managed to create a blacklist and avoid some specific logs but I'll implement what you mentioned to completely ignore the Information logs.

Re: How do you filter windows logs by level?

whrg — Fri, 28 Dec 2018 08:30:14 GMT

Filtering by blacklisting specific EventCodes works as well. Good thinking.