Getting Data In

How do you filter windows event log?

chengyu
Path Finder

Hi, when I do the filtering windows log, I use the main program 6.1.4 then changed forwarder license, so Windows AD (main program changed forwarder license ) >> forwarder(main program changed forwarder license ) >> splunk index is my architecture.
I hope drop eventcode=540 and 538, I have a reference to other people's actions, but unsuccessful.

transforms.conf

props.conf
[WinEventLog:Security] * Or [WMI:WinEventLog:Security] Or [wmi:WinEventLog:Security] Or [source::WinEventLog:Security]
TRANSFORMS-set = delete

[delete]
REGEX = (?msi)^EventCode=540 * Or REGEX=(?m)^EventCode=(540|538) Or REGEX=(?msi)^EventCode=(540|538)
DEST_KEY = queue
FORMAT = nullQueue

Tags (1)
0 Karma

splunker12er
Motivator

Set the below configs at indexer and give a try..

props.conf

[source::*:Security]
TRANSFORMS-set=setnull,setparsing

transforms.conf

[setparsing]
REGEX = .
DEST_KEY = queue
FORMAT =  indexQueue

[setnull]
REGEX =(?m)^EventCode=(540|538)
DEST_KEY = queue
FORMAT = nullQueue
0 Karma

jrodman
Splunk Employee
Splunk Employee

Not sure why you'd use [source::*:Security] If that works, then [source::WinEventLog:Security] would also work, and be a fair amount clearer, I think. I'd use the sourcetype myself.

This should indeed work, however, if there are no heavy forwarders along the way.

Filtering at the input level is more efficient, but it doesn't work with old versions of forwarders, so there's the tradeoff.

0 Karma

jrodman
Splunk Employee
Splunk Employee

I find this difficult to understand.

Do you mean that you have a forwarder sending to an indexer, or that you have a forwarder running with AD sending to another forwarder, that sends to an indexer?

Can you please show a specific case of your props.conf? Is the transforms.conf empty?

On which system are you setting up these configurations? Are the systems Universal Forwarders or forwarders configured as Splunk Light Forwarders?

It might be easier to use the WinEventLog filtering that is built-in to the input, for example:

[WinEventLog://Security]
blacklist= 540,538
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...