topic Windows Event Log Filter Attempt Failing in Getting Data In

Windows Event Log Filter Attempt Failing

jchensor — Thu, 03 May 2012 02:30:35 GMT

Hello, everyone.

I've looked at the following pages in Splunk Answers already, but after following everything they've done in there, I still cannot get my situation to work. 😞 But I looked through these:

http://splunk-base.splunk.com/answers/577/how-do-you-filter-windows-event-log
http://splunk-base.splunk.com/answers/13093/remote-event-log-windows-filtering-by-eventcode-not-working
http://splunk-base.splunk.com/answers/29218/filtering-windows-event-logs

So I basically have the same problem as the first link, but I can't get it to work, even with the techniques used in that issue. I want to filter out certain Windows Events by EventCode, but the settings don't seem to take. Here's my settings:

-- PROPS.CONF --

[WinEventLog:Security]
TRANSFORMS-wineventlog-security = wineventlog_security_setNull

-- TRANSFORMS.CONF --

[wineventlog_security_setNull]
REGEX = (?msi)^EventCode=4674\D
DEST_KEY = queue
FORMAT = nullQueue

I'm putting this on the Forwarder machine, as this occurs on the Forwarders, correct? Or should this be on the Indexers?

Thanks everyone!

James

Re: Windows Event Log Filter Attempt Failing

MuS — Thu, 03 May 2012 05:25:17 GMT

Hi jchensor

props.conf and transforms.conf are only handled on heavy forwarder and not on light or universal forwarder.

If your forwarder is s heavy, you could put props.conf and transforms.conf there.

If your forwarder is a light or universal forwarder, you must put your props.conf and transforms.conf on the indexer.

hope this helps

cheers,
MuS

Re: Windows Event Log Filter Attempt Failing

jchensor — Fri, 04 May 2012 21:06:07 GMT

Ahhhh, yes. ^_^ Thanks. Moving it to the indexer made it work exactly as I wanted. Thanks so much!!

Re: Windows Event Log Filter Attempt Failing

yannK — Tue, 31 Dec 2013 21:38:30 GMT

Additional method to filter since Splunk 6.*
http://answers.splunk.com/answers/116817/filter-wineventlog-events-based-on-the-eventcodes