Getting Data In

Delete Windows logs description at index time

pbalbasdtt
Path Finder

Hi all,

I´m trying to delete the description that came at the end of some windows events. From the CM I deployed the following configuration in the props.conf:

[host::my.windows.host]
SEDCMD-strip_detail_msg = s/(?ims)\s+^This\sevent\sis\generated\s.+//g

After looking into the events I can see that no SEDCMD has been applied.

I´m receiving these events from a UF that collects the logs via WMI with the Splunk_TA_windows. This TA is also installed on the indexers. Thanks in advance.

Best regards.

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The Splunk_TA_windows app has a setting to do that.  Copy the "SEDCMD-clean_info_text_from_winsystem_events_this_event" line to local/props.conf and un-comment it.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

The Splunk_TA_windows app has a setting to do that.  Copy the "SEDCMD-clean_info_text_from_winsystem_events_this_event" line to local/props.conf and un-comment it.

---
If this reply helps you, Karma would be appreciated.

pbalbasdtt
Path Finder

Hi,

I applied what you mention under WMI:WinEventLog:Security stanza and it is working like a charm. Many thanks for your help!

Regards.

0 Karma
Get Updates on the Splunk Community!

Security Highlights: September 2022 Newsletter

 September 2022 The Splunk App for Fraud Analytics (SFA) is now Splunk SupportedUse your existing Splunk ...

Platform Highlights | September 2022 Newsletter

 September 2022 What’s New in 9.0 and How to UpgradeGet a walk through of what is new Splunk Enterprise 9.0 ...

Observability Highlights | September 2022 Newsletter

 September 2022 Splunk Observability SuiteAccess to "Classic" SignalFx Interface Will be Removed on Sept 30, ...