Getting Data In

Filter Windows Event Data to different Targets?

rbal_splunk
Splunk Employee
Splunk Employee

Question : I would like to ingest windows event data using Splunk Heavy Forwarder and need to filter Windows event logs to Splunk indexer. Basically I want to index Winevent (Application , System and Setup) on indexer 136 , All the other winevent Security log to indexer 133 and only winevent Security for EventCode 4634 and 4672 to Indexer144

What are the options to meet this need?

0 Karma

rbal_splunk
Splunk Employee
Splunk Employee

My test is based on Splunk Version 6.3.3.

Here are the setting that worked for me.

1)On Heavy Forwarder – set inputs.conf as

[WinEventLog://Application]
checkpointInterval = 5
current_only = 0
disabled = 0
start_from = oldest

[WinEventLog://Security]
checkpointInterval = 5
current_only = 0
_TCP_ROUTING = LI_133
disabled = 0
start_from = oldest

[WinEventLog://Setup]
checkpointInterval = 5
current_only = 0
disabled = 0
start_from = oldest

[WinEventLog://System]
checkpointInterval = 5
current_only = 0
disabled = 0
start_from = oldest

2) Also Heavy Forwarder has props.conf and transforms.conf as

----Props.conf---------
[WinEventLog:Security]
TRANSFORMS-null= InCludeEvents

----transforms.conf-------
[InCludeEvents]
REGEX = EventCode=(4634|4672)
DEST_KEY = _TCP_ROUTING
FORMAT = LI_144

3) Also Heavy Forwarder-outputs.conf has

[tcpout]
indexAndForward = 1
autoLB = true
compressed = false
defaultGroup = LI_136

[tcpout:LI_136]
server = server_136:9997

[tcpout: LI_144]
server = server_136:9997

[tcpout:LI_133]
server = server_133:9997

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...