Getting Data In

Filtering windows events not successful on splunk forwarder?

remy06
Contributor

Hi,

I've installed splunk forwarder(regular) on windows server and trying to filter off certain events when sending to splunk indexer. Here is my sample configuration:

props.conf
[WinEventLog:Security]
TRANSFORMS-null = setnull

transform.conf
[setnull]
REGEX = (?m)^EventCode=(540|673|861)\b
DEST_KEY = queue
FORMAT = nullQueue

Splunk services were stopped while I'm editing the files and enabled after.The configuration was done on the forwarder itself.I did a search where "host=serverA EventCode=540" and I still see the events.

Any idea?

1 Solution

remy06
Contributor

This is working for me now..although there isn't much difference than the previous but here goes:

[setnull]
REGEX = (?msi)^EventCode=(540|673|861)\b
DEST_KEY = queue
FORMAT = nullQueue

View solution in original post

remy06
Contributor

I monitored the events after ive made the changes and still see them

0 Karma

remy06
Contributor

This is working for me now..although there isn't much difference than the previous but here goes:

[setnull]
REGEX = (?msi)^EventCode=(540|673|861)\b
DEST_KEY = queue
FORMAT = nullQueue

Jag
Splunk Employee
Splunk Employee

Is this LightWeightForwarder(LWF) or a regular forwarder? If this is LightWeightForwarder, this may not work as data is not not parsed into individual events in LWF.

0 Karma

remy06
Contributor

Am using a regular forwarder

0 Karma

hexx
Splunk Employee
Splunk Employee

Just making sure : When you say "I still see the events", are you referring to events that were indexed before you made your changes?

Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...