topic split windows event log in Getting Data In

split windows event log

mrain7 — Mon, 17 Feb 2014 04:27:45 GMT

Windows event log, I want to index only part of the message

exemple

LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=5447
EventType=0

SourceName order to index only part of what should you do?

Re: split windows event log

dshpritz — Mon, 17 Feb 2014 06:40:58 GMT

If you are running Splunk 6 on your forwarders, there are options for filtering what events and parts of the events you grab.

Otherwise, you should check out the docs info on how to Anonymize data, but rather than using the SED props configuration for anonymizing your data, you would be removing the parts you don't want to index.

HTH,

Dave

Re: split windows event log

mrain7 — Mon, 17 Feb 2014 07:31:51 GMT

thank you

but..i need message text hm..

Re: split windows event log

dshpritz — Mon, 17 Feb 2014 07:36:14 GMT

I'm sorry, I don't know what you mean by "text hm"

Re: split windows event log

mrain7 — Mon, 17 Feb 2014 07:49:00 GMT

sorry.

02/17/2014 01:33:30 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=정보
ComputerName=NIG-PC
TaskCategory=프로세스 만들기
OpCode=정보
RecordNumber=4470383
Keywords=감사 성공
Message=새 프로세스가 만들어져 있습니다.

I want to index the part in bold.

thanks

Re: split windows event log

dshpritz — Mon, 17 Feb 2014 07:55:25 GMT

No problem. In the props.conf on your indexer or heavy forwarder, you would need to add the following:

[WinEventLog:Security]

SED-remove_before_message = (?s).*(?=Message=)