Getting Data In

Filtering out data (from a forwarder) on Indexer?

spunk311z
Path Finder

hi, i have several universal forwarders deployed, and im getting lots of events i want to filter out.

I understand from reading answers here i need to do this on the indexer (or else install heavy forwaders on my endpoints, which i dont want to do).
This is a raw entry that im trying to drop / filter out from my indexer (ie to keep it from using up lots of my license):

02/13/2020 10:19:09.016
event_status="(0)The operation completed successfully."
pid=1216
process_image="c:\Program Files\VMware\VMware Tools\vmtoolsd.exe"
registry_type="CreateKey"
key_path="HKLM\system\controlset001\services\tcpip\parameters"
data_type="REG_NONE"
data=""

This is the entry from the inputs.conf on the forwarders that is sending some of the events i want to filter out:

    [WinRegMon://default]
    disabled = 0
    hive = .*
    proc = .*
    type = rename|set|delete|create

And i have added these lines on my indexer (and restarted), but im still seeing the events come in:

#on props.conf ( located in: C:\Program #Files\Splunk\etc\users\admin\search\local\props.conf):

[WinRegMon://default]
TRANSFORMS-set= setnull

#on transforms.conf ( located in: C:\Program #Files\Splunk\etc\users\admin\search\local\transforms.conf):

[setnull]
REGEX = process_image=.+vmtoolsd.exe"
DEST_KEY = queue
FORMAT = nullQueue

Thanks!
(ive been referencing many answers, including this good one):
(h)ttps:// answers.splunk.com/answers/37423/how-to-configure-a-forwarder-to-filter-and-send-the-specific-events-i-want.html

0 Karma

vinod94
Contributor
0 Karma

to4kawa
Ultra Champion

transforms.conf

[setnull]
REGEX = (?s).*process_image.*vmtoolsd\.exe.*
DEST_KEY = queue
FORMAT = nullQueue  

REGEX captures all.

0 Karma

manjunathmeti
SplunkTrust
SplunkTrust

Stanza name in props.conf should be source::<source*>* or sourcetype. Set sourcetype attribute in inputs.conf and use same as stanza in props.conf. You can also put props.conf and transforms.conf on universal forwarders.

inputs.conf

 [WinRegMon://default]
 disabled = 0
 hive = .*
 proc = .*
 type = rename|set|delete|create
 sourcetype = winregmonitor

props.conf

[winregmonitor]
TRANSFORMS-set= setnull
0 Karma

anmolpatel
Builder

after making the changes, did you do any of the following:
- run the search:
| extract reload=T
OR
- http[s]://[splunkWebHostname]:[splunkWebPort]/debug/refresh
OR
- restart splunk -- /opt/splunk/bin/splunk restart?

and then validate ?

0 Karma

isoutamo
SplunkTrust
SplunkTrust

You should put these under ...\etc\apps\local or ...\etc\system\local instead of under user\admin if you want use those on indexing time.

Ismo

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...