topic Re: WMI filter doesn't work in Getting Data In

WMI filter doesn't work

alain_bettiol — Fri, 01 Mar 2013 10:19:55 GMT

Hello, I try to modify the behaviour of a forwarder installed on a Windows server. I would like to prevent the forwarder from sending WINDOWS events EventType=4
I have tried everything but still doesn't work, all EventTypes (1, 2,3, 4) are still forwarded

Thanks for your help

My props.conf is :
[WMI:WinEventLog:System]
TRANSFORMS-wmi=wminullEvents

[WMI:WinEventLog:Security]
TRANSFORMS-wmi=wminullEvents

[WMI:WinEventLog:Application]
TRANSFORMS-wmi=wminullEvents

Transforms.conf is :
[wminullEvents]
REGEX=(?msi)^EventType=(4)
DEST_KEY=queue
FORMAT=nullQueue

Re: WMI filter doesn't work

martin_mueller — Fri, 01 Mar 2013 11:30:48 GMT

Is this on a heavy forwarder?

Re: WMI filter doesn't work

alain_bettiol — Fri, 01 Mar 2013 11:42:03 GMT

No I don't think so. I'm not sure but I think it is light forwarder. How can I recognize a heavy or light forwarder?

Re: WMI filter doesn't work

martin_mueller — Fri, 01 Mar 2013 12:00:50 GMT

Run this:

$SPLUNK_HOME/bin/splunk version

Re: WMI filter doesn't work

alain_bettiol — Fri, 01 Mar 2013 12:54:01 GMT

Splunk Universal Forwarder 5.0.2 (build 149561)

Re: WMI filter doesn't work

martin_mueller — Fri, 01 Mar 2013 13:19:21 GMT

A Universal Forwarder cannot do filtering based on the event content, you need a Heavy Forwarder for that.

Re: WMI filter doesn't work

alain_bettiol — Tue, 05 Mar 2013 07:38:31 GMT

I have installed the heavy forwarder but it doesn't forward any event.
I didn't configure props.conf and transforms.conf yet.
The process splunkd is running and config file outputs.conf seems correct.
Is there a logfile I can check to understand what happens ?
Thanks

Re: WMI filter doesn't work

alain_bettiol — Wed, 06 Mar 2013 07:49:49 GMT

I have found the cause, the default setup doesn't forward anything I have enabled sources in the manageR Now the events are forwarded by the heavy forwarder but the filtering doesn't work, everything is forwarded.