Getting Data In

Filter all windows event logs from single server

timmy13
Communicator

I need to filter all windows event log records from being indexed. I am using the universal forwarder, so on my indexers, I have the following:

props.conf

[host::myserver]
TRANSFORMS-winlogs = FilterWinSecurityLogs

transforms.conf

[FilterWinSecurityLogs]
REGEX=sourcetype=(WMI*|WinEvent*)
DEST_KEY=queue
FORMAT=nullQueue

THis doesn't seem to work.

Is the * wildcard valid in the REGEX valid?

Thanks!

Tags (2)
0 Karma

timmy13
Communicator

That would disable it across all windows servers. I just need it for ONE server. My transforms currently looks like this but is not working

[FilterAllWMILogs]
SOURCE_KEY = sourcetype
REGEX = .*WMI*
DEST_KEY = queue
FORMAT = nullQueue
0 Karma

timmy13
Communicator

`props.conf:

[host::myserver]
TRANSFORMS-winlogs = FilterAllWMILogs

transforms.conf:

[FilterAllWMILogs]
SOURCE_KEY = sourcetype
REGEX = .*WMI*
DEST_KEY = queue
FORMAT = nullQueue`

0 Karma

kristian_kolb
Ultra Champion

Hm. that SHOULD work, even if I would say that the REGEX should be;

REGEX = .xWMI.x

Where the x's above are asterisks. sorry about the formatting.

Are you referencing it correctly from props.conf (I saw you had changed the name of the transforms stanza).

I haven't used this type of transform myself, but I don't see why this should pose any real problems.

/K

0 Karma

kristian_kolb
Ultra Champion

Are you using the Deployment Server, and have all input configurations in the same deployed app?

/k

0 Karma

kristian_kolb
Ultra Champion

The best would naturally be to disable the monitoring on the host in question.

If this (for some odd reason) is NOT the way to go, then you should alter the transforms stanza like so;

[FilterWinSecurityLogs]
SOURCE_KEY = sourcetype
REGEX = .*WinEventLog.*
DEST_KEY = queue
FORMAT = nullQueue

Hope this helps,

Kristian

0 Karma

kristian_kolb
Ultra Champion

Well, I didn't mean that you should disable ALL monitoring, just the WinEventLog stuff.

Just find your inputs.conf and add disabled=1 to the WinEventLog stanza(s).

/k

0 Karma

timmy13
Communicator

No, I do not wish to disable monitoring as we still need application logs from this server. I'll give your suggest a shot, thanks.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...