Getting Data In

How do you filter Windows:Security:Events: 5145 using use transforms.conf and props.conf?

rfrazier
New Member

I am trying to filter Windows:Security:Events: 5145. I created the props.conf and the transforms.conf file listed below. I have it in a app called all_indexers which gets push to all indexers. The props.conf and the transforms.conf files are in the /all_indexers/local/ directory on each of the indexers. Some thing is amiss, but I can't seem to find it.

Contents of the transforms.conf

Filter Widows Security Events: 5145

[nullFilter-5145]
REGEX=(EventCode=5145)
DEST_KEY=queue
FORMAT=nullQueue

Contents of the props.conf

[source::WinEventLog:Security]
TRANSFORMS-nullQ=nullFilter-5145

0 Karma

bohrasaurabh
Communicator

in props.conf try stanza as

[source::*:Security]

in transforms you might have to change REGEX as

REGEX = (EventCode)=(5145)

0 Karma

rfrazier
New Member

I made the changes to transforms.conf and props.conf. These conf files are in $SPLUNKHOME/etc/apps/all_indexers/local.

Should these files be in $SPLUNKHOME/etc/system/local/ on each of the indexers instead?

0 Karma

bohrasaurabh
Communicator

This should be actually done within the Windows TA's local directory and then deployed to all Index servers. The location on the index server should be $SPLUNKHOME/etc/apps/{Windows_TA_NAME}/local.

If you have deployment server, then use that to deploy.

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...