Getting Data In

Events not being filtered from Universal forwarder

mlevenson
Explorer

Trying to figure out whey I have events showing up that I am not wanting. I only want the events listed below so trying to sort out why.

Transforms.conf
[winevtnull]
REGEX=(?m).
DEST_KEY=queue
FORMAT=nullQueue

[winevtparsing]
REGEX=(?m)^EventCode=(4720|4725|4727|4728|4740|4754|4767|4794|4726|4932|4933|4935|4936|4937|5136|5137|5138|5139|5141|4649|5148|5149|4719|4739|4865|4946|4947|4948|6145|4674|4697|4672|4673)
DEST_KEY=queue
FORMAT=indexQueue

Props.conf

[WinEventLog:Security]
TRANSFORMS-winevt=winevtnull, winevtparsing

Inputs.conf

[default]
host = server

[script://$SPLUNK_HOME\bin\scripts\splunk-perfmon.path]
disabled = 0

[WinEventLog:Application]

[WinEventLog:ForwardedEvents]

[WinEventLog:HardwareEvents]

[WinEventLog:Internet Explorer]

[WinEventLog:Security]
disabled = 0
start_from = newest
current_only = 0

[WinEventLog:Setup]

[WinEventLog:System]

0 Karma
1 Solution

Ayn
Legend

Universal Forwarders do not perform filtering, that has to be done on the indexer (or any other interim "heavy" Splunk instance that does parsing)

EDIT: Adding some info from the docs: http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Routeandfilterdatad

"Important: Only heavy forwarders can route or filter data at the event level. Universal forwarders and light forwarders do not have the ability to inspect individual events, but they can still forward data based on a data stream's host, source, or source type. They can also route based on the data's input stanza, as described here."

View solution in original post

0 Karma

Ayn
Legend

Universal Forwarders do not perform filtering, that has to be done on the indexer (or any other interim "heavy" Splunk instance that does parsing)

EDIT: Adding some info from the docs: http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Routeandfilterdatad

"Important: Only heavy forwarders can route or filter data at the event level. Universal forwarders and light forwarders do not have the ability to inspect individual events, but they can still forward data based on a data stream's host, source, or source type. They can also route based on the data's input stanza, as described here."

View solution in original post

0 Karma

mlevenson
Explorer

I also found I needed to remove (?m)^ since I was not doing WMI calls for the event gathering.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!