topic Re: How to drop logs from crowdtrike using transform.conf in Getting Data In

How to drop logs from crowdtrike using transform.conf

rtalcik — Wed, 29 Jan 2020 19:33:17 GMT

Hi All,

So first I want to apologize if I don't understand much as I am fairly new to the administration side.

However, I read some documentation that I can use transform.conf to drop logs from coming into splunk.

I am using a universal forwarder and I want a specific powershell script whitelisted.

Can anyone send me a documentation on how I would edit transform.conf to whitelist a specific powershell script? If there is a better way, that would work too.

Re: How to drop logs from crowdtrike using transform.conf

to4kawa — Thu, 30 Jan 2020 02:31:06 GMT

filtering-of-events-using-nullqueue.html

check this.

Re: How to drop logs from crowdtrike using transform.conf

rtalcik — Tue, 03 Mar 2020 14:43:09 GMT

you wanna post this as a question so I can accept it

Re: How to drop logs from crowdtrike using transform.conf

to4kawa — Tue, 03 Mar 2020 19:49:08 GMT

roger that!