Basic Windows Event filter via Universal Forwarder

[bcecka]

I've seen various answers to this general area of questioning, but I'm wondering what the current best practice is.

I've just setup a brand new Splunk server on a Linux machine, and I'm starting off by pointing Windows 2008 R2 servers to it with the Universal Forwarder. The catch here is that I don't want everything from the Windows Event Logs. I'm only interested in Warnings and Errors and ideally I don't want to have to parse them out on the server... I'd much prefer that they don't get transmitted at all. Thoughts?

[piebob · Accepted solution]

universal and light forwarders do not parse events, which is part of why they have a smaller resource footprint. if you want to filter specific events out before they hit your indexer, you must use a heavy forwarder (so that it can check the events individually). information about doing this is here:
http://www.splunk.com/base/Documentation/latest/Deploy/Routeandfilterdatad

[bcecka]

Based upon this, I installed a full instance, added some local logs, disabled splunkweb, and edited these files under /etc/system/local/:

props.conf

[source::WinEventLog:Application]
TRANSFORMS-null= setnull

[source::WinEventLog:DNS Server]
TRANSFORMS-null= setnull

[source::WinEventLog:Directory Service]
TRANSFORMS-null= setnull

[source::WinEventLog:Security]
TRANSFORMS-null= setnull

[source::WinEventLog:System]
TRANSFORMS-null= setnull

transforms.conf

[setnull]
REGEX = (?m)^Type=Information
DEST_KEY = queue
FORMAT = nullQueue

Is this the appropriate way of achieving what I'm looking for?