Getting Data In

Delete Windows logs description at index time

pbalbasdtt
Path Finder

Hi all,

I´m trying to delete the description that came at the end of some windows events. From the CM I deployed the following configuration in the props.conf:

[host::my.windows.host]
SEDCMD-strip_detail_msg = s/(?ims)\s+^This\sevent\sis\generated\s.+//g

After looking into the events I can see that no SEDCMD has been applied.

I´m receiving these events from a UF that collects the logs via WMI with the Splunk_TA_windows. This TA is also installed on the indexers. Thanks in advance.

Best regards.

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The Splunk_TA_windows app has a setting to do that.  Copy the "SEDCMD-clean_info_text_from_winsystem_events_this_event" line to local/props.conf and un-comment it.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

The Splunk_TA_windows app has a setting to do that.  Copy the "SEDCMD-clean_info_text_from_winsystem_events_this_event" line to local/props.conf and un-comment it.

---
If this reply helps you, Karma would be appreciated.

pbalbasdtt
Path Finder

Hi,

I applied what you mention under WMI:WinEventLog:Security stanza and it is working like a charm. Many thanks for your help!

Regards.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...