Getting Data In

How do you filter windows event log?

chengyu
Path Finder

Hi, when I do the filtering windows log, I use the main program 6.1.4 then changed forwarder license, so Windows AD (main program changed forwarder license ) >> forwarder(main program changed forwarder license ) >> splunk index is my architecture.
I hope drop eventcode=540 and 538, I have a reference to other people's actions, but unsuccessful.

transforms.conf

props.conf
[WinEventLog:Security] * Or [WMI:WinEventLog:Security] Or [wmi:WinEventLog:Security] Or [source::WinEventLog:Security]
TRANSFORMS-set = delete

[delete]
REGEX = (?msi)^EventCode=540 * Or REGEX=(?m)^EventCode=(540|538) Or REGEX=(?msi)^EventCode=(540|538)
DEST_KEY = queue
FORMAT = nullQueue

Tags (1)
0 Karma

splunker12er
Motivator

Set the below configs at indexer and give a try..

props.conf

[source::*:Security]
TRANSFORMS-set=setnull,setparsing

transforms.conf

[setparsing]
REGEX = .
DEST_KEY = queue
FORMAT =  indexQueue

[setnull]
REGEX =(?m)^EventCode=(540|538)
DEST_KEY = queue
FORMAT = nullQueue
0 Karma

jrodman
Splunk Employee
Splunk Employee

Not sure why you'd use [source::*:Security] If that works, then [source::WinEventLog:Security] would also work, and be a fair amount clearer, I think. I'd use the sourcetype myself.

This should indeed work, however, if there are no heavy forwarders along the way.

Filtering at the input level is more efficient, but it doesn't work with old versions of forwarders, so there's the tradeoff.

0 Karma

jrodman
Splunk Employee
Splunk Employee

I find this difficult to understand.

Do you mean that you have a forwarder sending to an indexer, or that you have a forwarder running with AD sending to another forwarder, that sends to an indexer?

Can you please show a specific case of your props.conf? Is the transforms.conf empty?

On which system are you setting up these configurations? Are the systems Universal Forwarders or forwarders configured as Splunk Light Forwarders?

It might be easier to use the WinEventLog filtering that is built-in to the input, for example:

[WinEventLog://Security]
blacklist= 540,538
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...