Windows Event Log Filtering

[servercentraljo]

I've found a number of answers on this but my brain just isn't braining how to do it. I'm looking to filter all of the security events that have a machine account name from my Windows servers to save on quota, as I'm not looking for events of computer accounts logging in an out. It looks like they represent a few gigs a day of our data which is huge.

What I've found so far says I need to edit props.conf and transform.conf to include the regex but I don't know which local folder to put these files in to deploy to my forwarders or my indexer. Following what was included in here, I've put the files into the local folder of the Splunk_TA_windows app: http://answers.splunk.com/answers/124942/filtering-windows-security-event-logs-with-regex

Is that where this filter belongs? How can I change the regex to kill off anything with a $ in the Account_Name field, not just event ID 4624? Thanks!

[servercentraljo]

So I edited the input.conf on the Splunk_TA_windows/local directory but from what I'm reading we need to use the heavy forwarder to blacklist based on a regex. I'm using the universal forwarder. Is that correct?

[rsennett_splunk]

The "old School method" in the answers thread you've noted works just fine...
But since you're mentioning the Windows Infrastructure App... it's probable that you're on 6.x+

In 6.x more Windows Event Specific stuff was added to inputs.conf directives...

You might want to check out the current inputs.conf documentation:
HERE specifically, once you've got the doc open search within the document for "# Windows Event Log Monitor" and then scroll down to the section on Whitelist/Blacklist.

as for the question of "on the forwarder" or "on the indexer' that depends on whether you want to send the events at all or only send what you know you want to index, and how you go about enacting your filtering. In this case... probably inputs.conf on the forwarder if you're going to use whitelist/blacklist

[servercentraljo]

So I edited the input.conf on the Splunk_TA_windows/local directory but from what I'm reading we need to use the heavy forwarder to blacklist based on a regex. I'm using the universal forwarder. Is that correct?