Hi Folks - testing the product out and trying to figure out this scenario.
Windows Server w/ Universal Forwarder --> Heavy Forwarder --> Specific Index on Indexer
Most of the above works and I have filtering based on specific events and account names are working too, the next step is getting traffic to a specific index on my indexer.
How do I do this? Referenced articles are not working.
On the indexer, I've created a new index
[source::*:Security] TRANSFORMS-set = setnull,seclog
On my transforms.conf I've got:
[seclog] REGEX = (?msi)(^EventCode=4634|4632).*(Account\sName:\t\tSUPER.) DEST_KEY = queue FORMAT = indexQueue
From what I understand 'format' should equal the new index name?
FORMAT = winevents
That's not working.
Figured it out, inputs.conf on the indexer:
index = winevents
At least I think I figured it out, still testing.
This will work if you want all WinEventLog events in the "winevents" index. The other method I posted will work to direct events on an event-by-event basis determined by the regex.
You can also put these settings at the HF level. Typically you want to apply settings as high up in the pipeline as possible. If using a UF you could specify index in inputs.conf but would have to use the props.conf/tranforms.conf at the indexer for my other solution. Let me know if you have any questions!
What you want to do is set the DEST_KEY to what value you want the FORMAT to change. Try:
[seclog] REGEX = (?msi)(^EventCode=4634|4632).*(Account\sName:\t\tSUPER.) DEST_KEY = _MetaData:Index FORMAT = index::winevent
Unfortunately this does not work. No more events after making those changes, restarting everything.
Change it back to transforms.conf
REGEX = (?msi)(^EventCode=4634|4632).*(Account\sName:\t\tSUPER.)
DEST_KEY = queue
FORMAT = indexQueue
And specifying the index on the inputs.conf on the Windows host appears to work. Have not been able to figure out how to do it from the HF.
Your props.conf and transforms.conf should be on HF, not on Indexer because parsing occurres on first full Splunk Enterprise instance from UF to Indexer.