Getting Data In

Filtering local input data - problem

btester
New Member

I have been trying for 2-3 days to get windows event log data to be filtered, and specifically dump a certain event id. After hours of attempts I decided to just get ALL event log data to dump to nullQueue and yet none of my attempts have been successful.

I have read several threads on the splunk site on how to setup nullQueue forwarding, but I am missing something. If anybody can shed light on this it will be appreciated.

In my current config %SPLUNK%\etc\system\local

In props.conf

[WinEventLog:Security]
TRANSFORMS-null = nullevent

in transforms.conf

[nullevent]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue

I have also tried in props.conf

[wmi]
TRANSFORMS-null = nullevent

[source::WinEventlog:Security]
TRANSFORMS-null = nullevent

however my security events continue to come in. This is a test only, once I am sure all events are being filtered I will seutp appropriate regex statements to filter out unnecessary data.

Tags (2)
0 Karma

wollinet
Path Finder

Despite what's mentioned in the documentation, I think you need REGEX = (.). I had a similar problem in a different scenarion and it seems that transforms only work if they have a matching group.

0 Karma

MarioM
Motivator

did you try to add (?m) in front of your regex and restart splunk services? Example: In props.conf:

[WinEventLog:Security]
TRANSFORMS-null = nullevent

In transforms.conf

[nullevent]
REGEX = (?m)^EventCode=(592|593)
DEST_KEY = queue
FORMAT = nullQueue
0 Karma
Get Updates on the Splunk Community!

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...

What's New in Splunk Observability - July 2025

What’s New?  We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what ...