I've been using for 1 year or so a configuration for my splunk forwarders as it is in this link:
I store everything in /etc/system/local/*
The files above are merged with files those that splunk creates when it installs itself.
lately (i think starting with some 4.1.x version of splunk, on windows 2008 R2 domain controllers i no longer get the results I want:
Could anyone take a look at the configuration files and tell me what should be changed in order to get splunk to filter out failed audits?
The config files are also supposed to filter out some audit success events, that is also not working, but that is secondary concern, first I'd like him to just make this simple failed audit/sucess audit filter that has been working fine for over 1 year.
To clear up a few things:
NO WMI filtering is done, i'm using the inputs file to explicitly disable it.
I've updated the files we use:
This is how we want to use splunk
So, I don't see your transforms.conf file in the rar you linked to, however, there were some bad things about trying to route data to nullQueue under Splunk 4.1.x and 4.2 that were specific to WMI, which is how it looks like this data is being pulled into Splunk. These defects have been fixed under 4.2.1, so you might want to try updating to see if that helps.