topic Re: Transforms.conf issue in Getting Data In

Transforms.conf issue

nmccaffery333 — Thu, 17 Sep 2020 16:29:04 GMT

We're working with a 30 day trial as we wait for procurement to purchase a full license. While learning and configuring the system, I'm working on getting rid of some events we don't want to see. So far it's not working.

My first question is, will this work on a Trial license?

If it will, here's what my files looks like. I've tried as many combinations and formats as I can find examples for. I had the Transforms settings all in one stanza to start with, below is my latest attempt.
If I run "splunk btool check", I see no errors.
Help! Please .

props.conf:

[WinEventLog:Security]
TRANSFORMS-security = setnull0

[WMI:WinEventLog:System]
TRANSFORMS-wmisystem = setnull1

[WinEventLog:System]
TRANSFORMS-system = setnull2

transforms.conf:

[setnull0]
SOURCE_KEY = dest
REGEX = ^EventCode=(1107|4688|7036|10028)\D
DEST_KEY = queue
FORMAT = nullQueue

[setnull1]
SOURCE_KEY = dest
REGEX = ^EventCode=(1107|4688|7036|10028)\D
DEST_KEY = queue
FORMAT = nullQueue

[setnull2]
SOURCE_KEY = dest
REGEX = ^EventCode=(1107|4688|7036|10028)\D
DEST_KEY = queue
FORMAT = nullQueue

Re: Transforms.conf issue

richgalloway — Thu, 17 Sep 2020 16:40:13 GMT

Yes, it will work with a trial license.

Try removing the ^ from the REGEX settings. The existing settings will fail since the events do not begin with "EventCode".

Re: Transforms.conf issue

nmccaffery333 — Thu, 17 Sep 2020 17:10:36 GMT

That makes sense, and I think I tried it before. I just tried it again and those events are still showing up.

Re: Transforms.conf issue

nmccaffery333 — Thu, 17 Sep 2020 17:13:53 GMT

Here's and example event;

09/17/2020 12:10:53 PM
LogName=System
SourceName=Microsoft-Windows-Service Control Manager
EventCode=7036
EventType=4
Type=Information
ComputerName=oneof.my.servers
TaskCategory=None
OpCode=The operation completed successfully.
RecordNumber=15183030