How do you filter out an event based on an account name?

[alexandrosd]

Hello,

I am trying to exclude specific event logs from a Windows system being forwarded and indexed to Splunk.

What I need to do is to filter out an event based on the content of the event (actually for a specific user called installer).

What i did so far is:

Under props.conf of universal forwarder ($PROGRAMFILES\SplunkUniversalForwarder\etc\apps\SplunkUniversalForwarder\local\props.conf) I defined the following:

[WinEventLog:Security]

TRANSFORMS-t1=exclude-installer

and under transforms.conf on the same path the following:

[exclude-installer]
REGEX=(?s)(Account Name:\s\sinstaller)
DEST_KEY=queue
FORMAT=nullQueue

The problem is that this specific configuration does not work. Events are not filtered out...

Any suggestions?

Thank you in advance.

[alexandrosd]

Thanks for the reply.
based on the docs, this means that i need to add this configuration for props.conf and transforms.conf, under $SPLUNK_HOME/etc/system/local/.
Im based on the "Filter WMI and Event Log events" on the doc.
Is that correct?

[hgrow · Accepted solution]

Hi alexandrosd ,

unfortunately you can not directly filter/route to null queue on your universal forwarder, since the universal forwarder does not parse the events so it's not able to apply props.conf / transforms.conf transformations.

Only a heavy-forwarder/indexer is parsing the data and is able to filter the events.

Depending on your architecture you would most likely want simply want to move your configuration to your indexer(s) if there is no heavy forwarder inbetween your universal forwarder and indexer tier.

More to read:

https://docs.splunk.com/Documentation/Splunk/7.2.4/Forwarding/Routeandfilterdatad

https://wiki.splunk.com/Community:HowIndexingWorks

Edit:
Since you are dealing with Windows Event Logs you can apply a so called backlist in your inputs.conf on your Universal Forwarder:

Something like

[WinEventLog://Security] 
...
blacklist1 = EventCode="your eventcode" Account_Name="installer"
...

Search for "blacklist" here: https://docs.splunk.com/Documentation/Splunk/7.2.4/Data/MonitorWindowseventlogdata

Sincerely,
hgrow

[alexandrosd]

Hello hgrow,
seems that the config on the indexer works perfect for me.
Changes made under $SPLUNK_HOME/etc/system/local/ and restarted splunk and voila.

Thank you.