topic Re: Windows 2008 event filtering in Monitoring Splunk

Windows 2008 event filtering

rriley — Mon, 18 Jun 2012 13:27:34 GMT

Trying to throw away events not wanted from a server - not working.

props.conf
[WinEventLog:Security]
TRANSFORMS-null = setnull

transform.conf
[setnull]
REGEX = (?m)^EventCode=(4658|4662|4689|4768|4769|4770|4771|4776|4931|4932|4933|4985|5136|5156)\D
DEST_KEY = queue
FORMAT = nullQueue

also tried:
REGEX = (?m)^EventCode=(4658|4662|4689|4768|4769|4770|4771|4776|4931|4932|4933|4985|5136|5156)\b

Any ideas?

Maybe this will be better than a support ticket - that takes forever to get an answer.

Re: Windows 2008 event filtering

rriley — Mon, 18 Jun 2012 13:29:19 GMT

for some reason the (Backslash)\ was omitted when I pasted:

REGEX = (?m)^EventCode=(4658|4662|4689|4768|4769|4770|4771|4776|4931|4932|4933|4985|5136|5156)(backslash)\D

and
REGEX = (?m)^EventCode=(4658|4662|4689|4768|4769|4770|4771|4776|4931|4932|4933|4985|5136|5156)(backslash)\b

Re: Windows 2008 event filtering

Starlette — Mon, 18 Jun 2012 13:47:23 GMT

did you try this without the (backslash)D ?

Re: Windows 2008 event filtering

yannK — Mon, 18 Jun 2012 14:36:10 GMT

Where are those props/transforms applied ?

They have to be where the events are parsed : on the indexer or on heavy forwarders, not on the Universal or Light Forwarders.

Re: Windows 2008 event filtering

rriley — Mon, 18 Jun 2012 14:40:31 GMT

Sorry this is the config of a full splunk install set to forward. Not a light forwarder.