https://community.splunk.com/t5/Splunk-Search/How-to-exclude-the-Windows-events-with-Splunk-process-before/m-p/342389#M101429 <P>Hi<BR /> following <A href="http://docs.splunk.com/Documentation/Splunk/6.6.2/Forwarding/Routeandfilterdatad">http://docs.splunk.com/Documentation/Splunk/6.6.2/Forwarding/Routeandfilterdatad</A> put in your indexers something like this:</P> <P>in props.conf</P> <PRE><CODE>[WinEventLog:Security] TRANSFORMS-set-exclude=set_exclude,set_nullqueue </CODE></PRE> <P>in transforms.conf</P> <PRE><CODE>[set_exclude] REGEX=. DEST_KEY = queue FORMAT = indexQueue [set_nullqueue] REGEX=C:\\Program Files\\SplunkUniversalForwarder\\bin\\\* DEST_KEY=queue FORMAT=nullQueue </CODE></PRE> <P>Bye.<BR /> Giuseppe</P> Mon, 31 Jul 2017 14:43:30 GMT gcusello 2017-07-31T14:43:30Z https://community.splunk.com/t5/Splunk-Search/How-to-exclude-the-Windows-events-with-Splunk-process-before/m-p/342383#M101423 <P>Hi,</P> <P>I see a lot of events in Windows logs with Process splunk-regmon, powershell etc. Is there a way to exclude the processes before indexing?</P> <P>message contains:</P> <PRE><CODE>C:\Program Files\SplunkUniversalForwarder\bin\* </CODE></PRE> Fri, 28 Jul 2017 16:40:20 GMT https://community.splunk.com/t5/Splunk-Search/How-to-exclude-the-Windows-events-with-Splunk-process-before/m-p/342383#M101423 kiran331 2017-07-28T16:40:20Z https://community.splunk.com/t5/Splunk-Search/How-to-exclude-the-Windows-events-with-Splunk-process-before/m-p/342384#M101424 <P>i think its better to disable the monitoring of regmon if possible<BR /> if you want to filter events, start here:<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/6.6.2/Forwarding/Routeandfilterdatad">http://docs.splunk.com/Documentation/Splunk/6.6.2/Forwarding/Routeandfilterdatad</A><BR /> hope it helps</P> Fri, 28 Jul 2017 17:32:33 GMT https://community.splunk.com/t5/Splunk-Search/How-to-exclude-the-Windows-events-with-Splunk-process-before/m-p/342384#M101424 adonio 2017-07-28T17:32:33Z https://community.splunk.com/t5/Splunk-Search/How-to-exclude-the-Windows-events-with-Splunk-process-before/m-p/342385#M101425 <P>Hi Adonio, </P> <P>I tried</P> <P>blacklist3 = EventCode="4688" Message="New Process Name: (?i)^(C:\Program Files\Splunk(?:UniversalForwarder)?\bin\(?:btool|splunkd|splunk|splunk-(?:MonitorNoHandle|admon|netmon|perfmon|powershell|regmon|winevtlog|winhostinfo|winprintmon|wmi)).exe)" in inputs.conf, its not working. Is there anything I have to change in it.</P> Fri, 28 Jul 2017 19:00:34 GMT https://community.splunk.com/t5/Splunk-Search/How-to-exclude-the-Windows-events-with-Splunk-process-before/m-p/342385#M101425 kiran331 2017-07-28T19:00:34Z https://community.splunk.com/t5/Splunk-Search/How-to-exclude-the-Windows-events-with-Splunk-process-before/m-p/342386#M101426 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/168759">@kiran331</a></P> <P>[WinEventLog:Security]<BR /> blacklist3 = EventCode="4688" New_Process_Name="C:\Program Files\SplunkUniversalForwarder\bin\*"</P> <P>I hope New_Process_Name as been extracted.</P> <P>or</P> <P>[WinEventLog:Security]<BR /> blacklist3 = EventCode="4688" Message="A new process has been created."</P> Tue, 29 Sep 2020 15:09:29 GMT https://community.splunk.com/t5/Splunk-Search/How-to-exclude-the-Windows-events-with-Splunk-process-before/m-p/342386#M101426 sbbadri 2020-09-29T15:09:29Z https://community.splunk.com/t5/Splunk-Search/How-to-exclude-the-Windows-events-with-Splunk-process-before/m-p/342387#M101427 <P>I tried blacklist3 = EventCode="4688" New_Process_Name="C:\Program Files\SplunkUniversalForwarder\bin\*", it dint worked</P> Tue, 29 Sep 2020 15:06:56 GMT https://community.splunk.com/t5/Splunk-Search/How-to-exclude-the-Windows-events-with-Splunk-process-before/m-p/342387#M101427 kiran331 2020-09-29T15:06:56Z https://community.splunk.com/t5/Splunk-Search/How-to-exclude-the-Windows-events-with-Splunk-process-before/m-p/342388#M101428 <P>you are missing a "\" at the end after bin\<BR /> there supposed to be 2 of them \</P> Mon, 31 Jul 2017 14:37:07 GMT https://community.splunk.com/t5/Splunk-Search/How-to-exclude-the-Windows-events-with-Splunk-process-before/m-p/342388#M101428 adonio 2017-07-31T14:37:07Z https://community.splunk.com/t5/Splunk-Search/How-to-exclude-the-Windows-events-with-Splunk-process-before/m-p/342389#M101429 <P>Hi<BR /> following <A href="http://docs.splunk.com/Documentation/Splunk/6.6.2/Forwarding/Routeandfilterdatad">http://docs.splunk.com/Documentation/Splunk/6.6.2/Forwarding/Routeandfilterdatad</A> put in your indexers something like this:</P> <P>in props.conf</P> <PRE><CODE>[WinEventLog:Security] TRANSFORMS-set-exclude=set_exclude,set_nullqueue </CODE></PRE> <P>in transforms.conf</P> <PRE><CODE>[set_exclude] REGEX=. DEST_KEY = queue FORMAT = indexQueue [set_nullqueue] REGEX=C:\\Program Files\\SplunkUniversalForwarder\\bin\\\* DEST_KEY=queue FORMAT=nullQueue </CODE></PRE> <P>Bye.<BR /> Giuseppe</P> Mon, 31 Jul 2017 14:43:30 GMT https://community.splunk.com/t5/Splunk-Search/How-to-exclude-the-Windows-events-with-Splunk-process-before/m-p/342389#M101429 gcusello 2017-07-31T14:43:30Z