Events not being filtered from Universal forwarder

[mlevenson]

Trying to figure out whey I have events showing up that I am not wanting. I only want the events listed below so trying to sort out why.

Transforms.conf
[winevtnull]
REGEX=(?m).
DEST_KEY=queue
FORMAT=nullQueue

[winevtparsing]
REGEX=(?m)^EventCode=(4720|4725|4727|4728|4740|4754|4767|4794|4726|4932|4933|4935|4936|4937|5136|5137|5138|5139|5141|4649|5148|5149|4719|4739|4865|4946|4947|4948|6145|4674|4697|4672|4673)
DEST_KEY=queue
FORMAT=indexQueue

Props.conf

[WinEventLog:Security]
TRANSFORMS-winevt=winevtnull, winevtparsing

Inputs.conf

[default]
host = server

[script://$SPLUNK_HOME\bin\scripts\splunk-perfmon.path]
disabled = 0

[WinEventLog:Application]

[WinEventLog:ForwardedEvents]

[WinEventLog:HardwareEvents]

[WinEventLog:Internet Explorer]

[WinEventLog:Security]
disabled = 0
start_from = newest
current_only = 0

[WinEventLog:Setup]

[WinEventLog:System]

[Ayn · Accepted solution]

Universal Forwarders do not perform filtering, that has to be done on the indexer (or any other interim "heavy" Splunk instance that does parsing)

EDIT: Adding some info from the docs: http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Routeandfilterdatad

"Important: Only heavy forwarders can route or filter data at the event level. Universal forwarders and light forwarders do not have the ability to inspect individual events, but they can still forward data based on a data stream's host, source, or source type. They can also route based on the data's input stanza, as described here."

[mlevenson]

I also found I needed to remove (?m)^ since I was not doing WMI calls for the event gathering.