Getting Data In

How can I create a filter to capture certain events from security logs?

New Member

Hi All,

I'm a newbie to the Splunk world and trying to figure out a couple things. I currently have Splunk Light installed and used the "Remote Event Log Collection" option to collect logs from my system. My question is: Can I create filters to only capture certain events from the security logs? Or do I need to configure the universal forwarder to collect the logs from my systems then configure filters prior to data getting indexed? Thanks, any info you can provide would be great.

0 Karma
1 Solution

Legend

You should let the universal forwarder collect the entire log and then filter on the indexer.

Exception: for Windows event logs, you can blacklist or whitelist event codes on the universal forwarder. To do this, you will need to add filters to the inputs.conf on the universal forwarder, as described in Monitor Windows event log data: Create advanced filters with 'whitelist' and 'blacklist'

View solution in original post

Legend

You should let the universal forwarder collect the entire log and then filter on the indexer.

Exception: for Windows event logs, you can blacklist or whitelist event codes on the universal forwarder. To do this, you will need to add filters to the inputs.conf on the universal forwarder, as described in Monitor Windows event log data: Create advanced filters with 'whitelist' and 'blacklist'

View solution in original post

New Member

Thanks for the response. Last question, does the universal forwarder need to be configured on a separate system from the Splunk Light server?

0 Karma

SplunkTrust
SplunkTrust

Yes, the Universal Forwarder sits on the remote machine which is generating data.. The Forwarder will send this data to the indexer (Where Splunk is installed)

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!