topic Re: Exclusion Not Working In Transforms.Conf File in Splunk Search

Exclusion Not Working In Transforms.Conf File

itsomana — Thu, 10 Nov 2011 14:45:17 GMT

I have four Windows 2008 R2 servers each running a Splunk Univerisal Forwarder. On the Splunk server in the transforms.Conf file which resides in C:\Program Files\Splunk\etc\system\local I have the following configuration:

[FilterSecurityEvents]
REGEX = (?m)EventCode=(5156)
DEST_KEY = queue
FORMAT = nullQueue

In the props.conf file which also resides in C:\Program Files\Splunk\etc\system\local I have the following entry:

[WinEventLog:Security]
TRANSFORMS-Filter_Events = FilterSecurityEvents

I am trying to stop EventCode 5156 being indexed, however this event code is still being index by Splunk. Does anyone have any idea as to why this is happening?

From browsing other splunkbase posts I have noticed that I am missing in the string ^ Should my entry be: REGEX = (?m)^EventCode=(5156)

Re: Exclusion Not Working In Transforms.Conf File

tgow — Thu, 10 Nov 2011 18:04:02 GMT

The Windows Event Codes can be tricky sometimes with the filtering.

I am wondering if the paratheses on the REGEX could be causing a problem and adding an anchor, ie:

[FilterSecurityEvents]
REGEX = (?m)^EventCode=5156
DEST_KEY = queue
FORMAT = nullQueue

Re: Exclusion Not Working In Transforms.Conf File

itsomana — Fri, 11 Nov 2011 13:33:17 GMT

I have put in ^ into the Regex field REGEX = (?m)^EventCode=5156 then restarted splunk, however splunk was still logging Event Code 5156.

I then took the brackets from around (5156) then restarted splunk, however still no luck

Re: Exclusion Not Working In Transforms.Conf File

tgow — Fri, 11 Nov 2011 18:48:09 GMT

You cannot filter events into the nullqueue on a Universal Forwarder. You will need to move the props.conf and transforms.conf onto the Indexer. Try this and the data should be sent to the nullqueue before it is indexed.

Re: Exclusion Not Working In Transforms.Conf File

erstexas — Tue, 18 Jun 2013 17:54:16 GMT

Was anybody ever able to get this working?