Getting Data In

Filter all windows event logs from single server

Communicator

I need to filter all windows event log records from being indexed. I am using the universal forwarder, so on my indexers, I have the following:

props.conf

[host::myserver]
TRANSFORMS-winlogs = FilterWinSecurityLogs

transforms.conf

[FilterWinSecurityLogs]
REGEX=sourcetype=(WMI*|WinEvent*)
DEST_KEY=queue
FORMAT=nullQueue

THis doesn't seem to work.

Is the * wildcard valid in the REGEX valid?

Thanks!

Tags (2)
0 Karma

Communicator

That would disable it across all windows servers. I just need it for ONE server. My transforms currently looks like this but is not working

[FilterAllWMILogs]
SOURCE_KEY = sourcetype
REGEX = .*WMI*
DEST_KEY = queue
FORMAT = nullQueue
0 Karma

Communicator

`props.conf:

[host::myserver]
TRANSFORMS-winlogs = FilterAllWMILogs

transforms.conf:

[FilterAllWMILogs]
SOURCE_KEY = sourcetype
REGEX = .*WMI*
DEST_KEY = queue
FORMAT = nullQueue`

0 Karma

Ultra Champion

Hm. that SHOULD work, even if I would say that the REGEX should be;

REGEX = .xWMI.x

Where the x's above are asterisks. sorry about the formatting.

Are you referencing it correctly from props.conf (I saw you had changed the name of the transforms stanza).

I haven't used this type of transform myself, but I don't see why this should pose any real problems.

/K

0 Karma

Ultra Champion

Are you using the Deployment Server, and have all input configurations in the same deployed app?

/k

0 Karma

Ultra Champion

The best would naturally be to disable the monitoring on the host in question.

If this (for some odd reason) is NOT the way to go, then you should alter the transforms stanza like so;

[FilterWinSecurityLogs]
SOURCE_KEY = sourcetype
REGEX = .*WinEventLog.*
DEST_KEY = queue
FORMAT = nullQueue

Hope this helps,

Kristian

0 Karma

Ultra Champion

Well, I didn't mean that you should disable ALL monitoring, just the WinEventLog stuff.

Just find your inputs.conf and add disabled=1 to the WinEventLog stanza(s).

/k

0 Karma

Communicator

No, I do not wish to disable monitoring as we still need application logs from this server. I'll give your suggest a shot, thanks.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!