Filter WinEventLog

[mildorp]

Hi, i need of the filter for Windows Logs, in Splunk Web, ok....more i need in inputs in each machine.
TaskCategory="Logon" OR "logoff" Logon_Type="2" OR Logon_Type="3" OR Logon_Type="10" OR Logon_Type="11"

thanks..

[yannK]

The props/transforms only apply when the events are parsed, so only on the indexers (or heavy forwarders)
It will not work in the universal or lightweight forwarders.

[mildorp]

Thanks...
I need to use this filter in transforms.conf and propos.conf the file, however it's not working.

[Jon_Webster]

I'm not sure what you're asking for. I tried the search below on our system and it works fine:

index="main" (TaskCategory="Logon" OR TaskCategory="logoff") (Logon_Type="2" OR Logon_Type="3" OR Logon_Type="10" OR Logon_Type="11")

Are you getting the events you want?

Note that your search: TaskCategory="Logon" OR "logoff" will get any events that contain the work "logoff", even if they are not in the TaskCategory field.

You might want to use (TaskCategory="Logon" OR TaskCategory="logoff")

[mildorp]

Thanks...
I need to use this filter in transforms.conf and propos.conf the file, however it's not working.