Getting Data In

How do you filter out an event based on an account name?

alexandrosd
New Member

Hello,

I am trying to exclude specific event logs from a Windows system being forwarded and indexed to Splunk.

What I need to do is to filter out an event based on the content of the event (actually for a specific user called installer).

What i did so far is:

Under props.conf of universal forwarder ($PROGRAMFILES\SplunkUniversalForwarder\etc\apps\SplunkUniversalForwarder\local\props.conf) I defined the following:

[WinEventLog:Security]

TRANSFORMS-t1=exclude-installer

and under transforms.conf on the same path the following:

[exclude-installer]
REGEX=(?s)(Account Name:\s\sinstaller)
DEST_KEY=queue
FORMAT=nullQueue

The problem is that this specific configuration does not work. Events are not filtered out...

Any suggestions?

Thank you in advance.

0 Karma
1 Solution

hgrow
Communicator

Hi alexandrosd ,

unfortunately you can not directly filter/route to null queue on your universal forwarder, since the universal forwarder does not parse the events so it's not able to apply props.conf / transforms.conf transformations.

Only a heavy-forwarder/indexer is parsing the data and is able to filter the events.

Depending on your architecture you would most likely want simply want to move your configuration to your indexer(s) if there is no heavy forwarder inbetween your universal forwarder and indexer tier.

More to read:

https://docs.splunk.com/Documentation/Splunk/7.2.4/Forwarding/Routeandfilterdatad

https://wiki.splunk.com/Community:HowIndexingWorks

Edit:
Since you are dealing with Windows Event Logs you can apply a so called backlist in your inputs.conf on your Universal Forwarder:

Something like

[WinEventLog://Security] 
...
blacklist1 = EventCode="your eventcode" Account_Name="installer"
...

Search for "blacklist" here: https://docs.splunk.com/Documentation/Splunk/7.2.4/Data/MonitorWindowseventlogdata

Sincerely,
hgrow

View solution in original post

0 Karma

alexandrosd
New Member

Thanks for the reply.
based on the docs, this means that i need to add this configuration for props.conf and transforms.conf, under $SPLUNK_HOME/etc/system/local/.
Im based on the "Filter WMI and Event Log events" on the doc.
Is that correct?

0 Karma

hgrow
Communicator

Hi alexandrosd ,

unfortunately you can not directly filter/route to null queue on your universal forwarder, since the universal forwarder does not parse the events so it's not able to apply props.conf / transforms.conf transformations.

Only a heavy-forwarder/indexer is parsing the data and is able to filter the events.

Depending on your architecture you would most likely want simply want to move your configuration to your indexer(s) if there is no heavy forwarder inbetween your universal forwarder and indexer tier.

More to read:

https://docs.splunk.com/Documentation/Splunk/7.2.4/Forwarding/Routeandfilterdatad

https://wiki.splunk.com/Community:HowIndexingWorks

Edit:
Since you are dealing with Windows Event Logs you can apply a so called backlist in your inputs.conf on your Universal Forwarder:

Something like

[WinEventLog://Security] 
...
blacklist1 = EventCode="your eventcode" Account_Name="installer"
...

Search for "blacklist" here: https://docs.splunk.com/Documentation/Splunk/7.2.4/Data/MonitorWindowseventlogdata

Sincerely,
hgrow

View solution in original post

0 Karma

alexandrosd
New Member

Hello hgrow,
seems that the config on the indexer works perfect for me.
Changes made under $SPLUNK_HOME/etc/system/local/ and restarted splunk and voila.

Thank you.

0 Karma