Getting Data In
Highlighted

Events not being filtered from Universal forwarder

Explorer

Trying to figure out whey I have events showing up that I am not wanting. I only want the events listed below so trying to sort out why.

Transforms.conf
[winevtnull]
REGEX=(?m).
DEST_KEY=queue
FORMAT=nullQueue

[winevtparsing]
REGEX=(?m)^EventCode=(4720|4725|4727|4728|4740|4754|4767|4794|4726|4932|4933|4935|4936|4937|5136|5137|5138|5139|5141|4649|5148|5149|4719|4739|4865|4946|4947|4948|6145|4674|4697|4672|4673)
DEST_KEY=queue
FORMAT=indexQueue

Props.conf

[WinEventLog:Security]
TRANSFORMS-winevt=winevtnull, winevtparsing

Inputs.conf

[default]
host = server

[script://$SPLUNK_HOME\bin\scripts\splunk-perfmon.path]
disabled = 0

[WinEventLog:Application]

[WinEventLog:ForwardedEvents]

[WinEventLog:HardwareEvents]

[WinEventLog:Internet Explorer]

[WinEventLog:Security]
disabled = 0
startfrom = newest
current
only = 0

[WinEventLog:Setup]

[WinEventLog:System]

0 Karma
Highlighted

Re: Events not being filtered from Universal forwarder

Legend

Universal Forwarders do not perform filtering, that has to be done on the indexer (or any other interim "heavy" Splunk instance that does parsing)

EDIT: Adding some info from the docs: http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Routeandfilterdatad

"Important: Only heavy forwarders can route or filter data at the event level. Universal forwarders and light forwarders do not have the ability to inspect individual events, but they can still forward data based on a data stream's host, source, or source type. They can also route based on the data's input stanza, as described here."

View solution in original post

0 Karma
Highlighted

Re: Events not being filtered from Universal forwarder

Explorer

I also found I needed to remove (?m)^ since I was not doing WMI calls for the event gathering.

0 Karma