Limit the events forwarded by Splunk Universal Forwarder (Minimise Data Use)

[gethersj]

Hi there 

New here to using Splunk, we are looking to use Splunk Universal Forwarder to forward windows event logs to a splunk server. 

I have installed the forwarder on a win10 client and i can see events coming into Splunk which is great! 

Is there any way that i can tweek the Universal Forwarder on the client PC to not forward some events such as Information logs, Audit Success, and possibly stop forwarding all the text from the event such as the description and all that?

Trying to be as lean as possible with these events really. 

Thanks

[nyc_jason]

this may be what youre looking for: https://docs.splunk.com/Documentation/Splunk/8.2.2/Data/MonitorWindowseventlogdata#Create_advanced_f...

[gethersj]

Has anyone got sample config files for Windows TA that I could use to test, or anyone got a simplistic guide on how to set it all up with the blacklists and filtering applied etc?

Thanks

[gethersj]

Thanks for this, but everything I see seems to do with when you use the Windows TA App etc. All i want really is to have SplunkUniversalForwarder on all desktops. Then we will create some dashboards our own, is there a way to limit what the forwarder sends to Splunk Indexer?

Im new to all of this also 🙂 

Thanks

[richgalloway]

If you can't use the Windows TA for some reason, at least download it to see how it works.  It's just a collection of config files so it should be easy to use it as a model for your own configuration.

[gethersj]

Hi, 

I can use Windows TA just it seems you need to set up a deployment server etc and I really didnt want this as the infrastructure is VDI, all i wanted was to put one agent on a golden image then push this out to all clients. 

After configuring the Windows TA and all the config files, is there a way to deploy this to the end clients without having to have the deployments server etc?

Thanks

[ephemeric]

Just copy the app to etc/apps on your Splunk image. Same thing as deploying said app.

Just be forewarned: you lose the ability to do any updates after deployment using a DS. If there are any required changes... problem.

You can also use a config management tool like Chef, Ansible, Puppet etc.

If networking is an issue: have the indexer(s) and DS on the same host as that then only requires a single dest IP to ports 8089, 9997.

[gethersj]

"Just copy the app to etc/apps on your Splunk image. Same thing as deploying said app."

So copy the Win TA folder to the Client PC , then it should work? 

Sorry little confused with it all. 

I have a Splunk Server with WindowsTA installed, then the config files all set up etc. 

What do i need to copy from the Splunk Server to the Windows Clients, i have the SplunkUniversalForwarder on the client PC. But there is no Windows TA folder on that Client PC is there. 

Thanks

[ephemeric]

Yes, copy the directory to the forwarders etc/apps.

[richgalloway]

You can use the blacklist settings in inputs.conf to drop undesired events.

[ephemeric]

Please search for "discard events" on Answers. Many posts explaining how to do what you require.