Getting Data In

How do you filter out an event based on an account name?

alexandrosd
New Member

Hello,

I am trying to exclude specific event logs from a Windows system being forwarded and indexed to Splunk.

What I need to do is to filter out an event based on the content of the event (actually for a specific user called installer).

What i did so far is:

Under props.conf of universal forwarder ($PROGRAMFILES\SplunkUniversalForwarder\etc\apps\SplunkUniversalForwarder\local\props.conf) I defined the following:

[WinEventLog:Security]

TRANSFORMS-t1=exclude-installer

and under transforms.conf on the same path the following:

[exclude-installer]
REGEX=(?s)(Account Name:\s\sinstaller)
DEST_KEY=queue
FORMAT=nullQueue

The problem is that this specific configuration does not work. Events are not filtered out...

Any suggestions?

Thank you in advance.

0 Karma
1 Solution

hgrow
Communicator

Hi alexandrosd ,

unfortunately you can not directly filter/route to null queue on your universal forwarder, since the universal forwarder does not parse the events so it's not able to apply props.conf / transforms.conf transformations.

Only a heavy-forwarder/indexer is parsing the data and is able to filter the events.

Depending on your architecture you would most likely want simply want to move your configuration to your indexer(s) if there is no heavy forwarder inbetween your universal forwarder and indexer tier.

More to read:

https://docs.splunk.com/Documentation/Splunk/7.2.4/Forwarding/Routeandfilterdatad

https://wiki.splunk.com/Community:HowIndexingWorks

Edit:
Since you are dealing with Windows Event Logs you can apply a so called backlist in your inputs.conf on your Universal Forwarder:

Something like

[WinEventLog://Security] 
...
blacklist1 = EventCode="your eventcode" Account_Name="installer"
...

Search for "blacklist" here: https://docs.splunk.com/Documentation/Splunk/7.2.4/Data/MonitorWindowseventlogdata

Sincerely,
hgrow

View solution in original post

0 Karma

alexandrosd
New Member

Thanks for the reply.
based on the docs, this means that i need to add this configuration for props.conf and transforms.conf, under $SPLUNK_HOME/etc/system/local/.
Im based on the "Filter WMI and Event Log events" on the doc.
Is that correct?

0 Karma

hgrow
Communicator

Hi alexandrosd ,

unfortunately you can not directly filter/route to null queue on your universal forwarder, since the universal forwarder does not parse the events so it's not able to apply props.conf / transforms.conf transformations.

Only a heavy-forwarder/indexer is parsing the data and is able to filter the events.

Depending on your architecture you would most likely want simply want to move your configuration to your indexer(s) if there is no heavy forwarder inbetween your universal forwarder and indexer tier.

More to read:

https://docs.splunk.com/Documentation/Splunk/7.2.4/Forwarding/Routeandfilterdatad

https://wiki.splunk.com/Community:HowIndexingWorks

Edit:
Since you are dealing with Windows Event Logs you can apply a so called backlist in your inputs.conf on your Universal Forwarder:

Something like

[WinEventLog://Security] 
...
blacklist1 = EventCode="your eventcode" Account_Name="installer"
...

Search for "blacklist" here: https://docs.splunk.com/Documentation/Splunk/7.2.4/Data/MonitorWindowseventlogdata

Sincerely,
hgrow

0 Karma

alexandrosd
New Member

Hello hgrow,
seems that the config on the indexer works perfect for me.
Changes made under $SPLUNK_HOME/etc/system/local/ and restarted splunk and voila.

Thank you.

0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...