Getting Data In

How can I filter the contents of an eventID without blacklisting it?

splunktrainingu
Communicator

I am currently trying to filter EventCode 4703. I wanted to do this via blacklist but not fully block the EventCode but simply do like a regex to filter on Account Names ending in $ and drop those logs from sending to splunk.  Also I am trying to filter 4688 and 4689. I was following this, https://gist.github.com/automine/a3915d5238e2967c8d44b0ebcfb66147  , guide but it doesn't seem to work for me. 

Labels (3)
0 Karma

splunktrainingu
Communicator

Thank you for this. I was able to do this on the Universal forwarder though.  If I drop it on the UF does it dropt hem to null queue as well? 

0 Karma

ivanreis
Builder

Hi @splunktrainingu ,

Try this configuration. Please deploy it to Indexer tier to drop the events to null queue.

props.conf

[WinEventLog:Security]
TRANSFORMS-DropWinEvents = drop-eventcodes
transforms.conf

[drop-eventcodes]
REGEX = (?m)^EventCode=(4703|4688|4689)
DEST_KEY = queue
FORMAT = nullQueue


There is other solution where a regex expression is being used to filter out some specific events like EventCode 4624, so my suggestion is for checking how the data is after splunk indexed in order to get the correct regex expression to match the piece of the data you want to drop from indexing.

https://community.splunk.com/t5/Getting-Data-In/Filtering-events-using-NullQueue/m-p/66392

If this help, please upvote.

 

0 Karma