Getting Data In

Filtering local input data - problem

btester
New Member

I have been trying for 2-3 days to get windows event log data to be filtered, and specifically dump a certain event id. After hours of attempts I decided to just get ALL event log data to dump to nullQueue and yet none of my attempts have been successful.

I have read several threads on the splunk site on how to setup nullQueue forwarding, but I am missing something. If anybody can shed light on this it will be appreciated.

In my current config %SPLUNK%\etc\system\local

In props.conf

[WinEventLog:Security]
TRANSFORMS-null = nullevent

in transforms.conf

[nullevent]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue

I have also tried in props.conf

[wmi]
TRANSFORMS-null = nullevent

[source::WinEventlog:Security]
TRANSFORMS-null = nullevent

however my security events continue to come in. This is a test only, once I am sure all events are being filtered I will seutp appropriate regex statements to filter out unnecessary data.

Tags (2)
0 Karma

wollinet
Path Finder

Despite what's mentioned in the documentation, I think you need REGEX = (.). I had a similar problem in a different scenarion and it seems that transforms only work if they have a matching group.

0 Karma

MarioM
Motivator

did you try to add (?m) in front of your regex and restart splunk services? Example: In props.conf:

[WinEventLog:Security]
TRANSFORMS-null = nullevent

In transforms.conf

[nullevent]
REGEX = (?m)^EventCode=(592|593)
DEST_KEY = queue
FORMAT = nullQueue
0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...