Getting Data In

Filtering windows events not successful on splunk forwarder?

Contributor

Hi,

I've installed splunk forwarder(regular) on windows server and trying to filter off certain events when sending to splunk indexer. Here is my sample configuration:

props.conf
[WinEventLog:Security]
TRANSFORMS-null = setnull

transform.conf
[setnull]
REGEX = (?m)^EventCode=(540|673|861)\b
DEST_KEY = queue
FORMAT = nullQueue

Splunk services were stopped while I'm editing the files and enabled after.The configuration was done on the forwarder itself.I did a search where "host=serverA EventCode=540" and I still see the events.

Any idea?

1 Solution

Contributor

This is working for me now..although there isn't much difference than the previous but here goes:

[setnull]
REGEX = (?msi)^EventCode=(540|673|861)\b
DEST_KEY = queue
FORMAT = nullQueue

View solution in original post

Contributor

I monitored the events after ive made the changes and still see them

0 Karma

Contributor

This is working for me now..although there isn't much difference than the previous but here goes:

[setnull]
REGEX = (?msi)^EventCode=(540|673|861)\b
DEST_KEY = queue
FORMAT = nullQueue

View solution in original post

Splunk Employee
Splunk Employee

Is this LightWeightForwarder(LWF) or a regular forwarder? If this is LightWeightForwarder, this may not work as data is not not parsed into individual events in LWF.

0 Karma

Contributor

Am using a regular forwarder

0 Karma

Splunk Employee
Splunk Employee

Just making sure : When you say "I still see the events", are you referring to events that were indexed before you made your changes?