Filtering Events

[jdonovan]

I am trying to filter events, and am not having any luck.

Log info in Splunk:
LogName=System
SourceName=Microsoft-Windows-Service Control Manager
EventCode=7036
EventType=4
Type=Information
ComputerName=xxNAMExx
TaskCategory=The operation completed successfully.
OpCode=The operation completed successfully.
RecordNumber=29077
Keywords=Classic
Message=The WMI Performance Adapter service entered the stopped state.

these files have been changed on the machine that forwards the data.

props.conf
[WMI:WinEventLog:System]
TRANSFORMS-wmi=wminull

transforms.conf
[wminull]
REGEX=(?m)^EventCode=(7036)
DEST_KEY=queue
FORMAT=nullQueue

what am i missing?
thanks

[jbsplunk]

You can't do this on a universal forwarder. It needs to happen where the data is parsed, which is either at the indexer or the heavy forwarder acting as an intermediate forwarder.

[erstexas]

Can this be a feature request? Why saturate the network and bog down the indexer with events that you do not even want?

[sowings]

Sending things to the nullQueue can only happen at parse time. You might consider tuning down some of the "interval" settings in wmi.conf, however

[jbsplunk]

There are not any ways to further limit which system events are sent. You could remove the system events completely, but if you only want to have certain system events, those have to be thrown out at the indexer.

[jdonovan]

i saw that after looking for a different way to do this. the problem is we want to limit what gets sent to the indexer because of the bandwidth usage. changing forwarders would not be an option as we have 800+ clients forwarding data. are there any other ways to limit what is sent?

[jdonovan]

i am using a universal forwarder, if that matters and spunk version 4.3