topic Re: Filtering events and Windows Platform Filtering events in Splunk Search

Filtering events and Windows Platform Filtering events

ejdavis — Wed, 09 Oct 2013 18:30:03 GMT

When adding a new filter to props.conf and transforms.conf does it remove events that have already been indexed or only new incoming events?

We are attempting to filter out all "Windows Platform Filtering" events. Is there a regex to do this, or will we need to have a regex for each Event Code?

From a previous question I was given:

(?msi)^EventCode=5156D

If I search "EventCode=5156" there's plenty of results.

I am attempting to search via:

| regex _raw=(?msi)^EventCode=5156D

I am unable to find anything

Re: Filtering events and Windows Platform Filtering events

lukejadamec — Wed, 09 Oct 2013 18:35:13 GMT

| regex _raw=(?msi)^EventCode=5156\D

I think it was missing a \ before the D.
You can also run this without the \D

| regex _raw=(?msi)^EventCode=5156

Re: Filtering events and Windows Platform Filtering events

ejdavis — Wed, 09 Oct 2013 18:49:43 GMT

I'm still unable to find any results via search with either of those regex expressions

But I am able to see thousands of events when I search, "EventCode=5156"

Re: Filtering events and Windows Platform Filtering events

gregbujak — Wed, 09 Oct 2013 18:52:11 GMT

It will never remove anything from the index. You have to use the cli clear command. Technically, even "| delete" doesnt remove it from the index (masks it).

To filter out multiple events, see this post:
http://answers.splunk.com/answers/59370/filtering-events-using-nullqueue

Re: Filtering events and Windows Platform Filtering events

sowings — Wed, 09 Oct 2013 19:02:41 GMT

Splunk's latest release, version 6, builds event ID filtering into the WinEventLog inputs. See inputs.conf documentation for more details.

Re: Filtering events and Windows Platform Filtering events

lukejadamec — Wed, 09 Oct 2013 19:21:52 GMT

I just tested
| regex _raw=(?msi)^EventCode=5156
and it worked. You can also use
| regex EventCode=5156
I looked at the most recent inputs.conf information, but I did not see what sowings was refering to. I'm sure it is there, but will take some reading.

Re: Filtering events and Windows Platform Filtering events

sowings — Wed, 09 Oct 2013 19:31:19 GMT

[WinEventLog] inputs, whitelist / blacklist.

Re: Filtering events and Windows Platform Filtering events

lukejadamec — Wed, 09 Oct 2013 19:38:56 GMT

Well that does look easy.
If you are running Splunk6
Try adding
blacklist = 5156
to your inputs.conf stanza for the wmi:wineventlog:security source. And thank sowings.