Getting Data In

How do you filter windows logs by level?

crsupportddc
Explorer

Is there any way to get only critical and error logs from Windows?

I mean, Windows generates logs using different levels (Critical, Warning, Error, Information...) and I don't want the Information logs on Splunk, so I would like to configure the forwarder to not send them.

0 Karma
1 Solution

whrg
Motivator

Hello @crsupportddc,

So I assume the Windows events (which are multiline) contain this line which you want to base your filter on:

Type=Information

Check out this page on how to filter specific events: Discard specific events and keep the rest.

On your heavy forwarder/indexer (whatever system comes after the Universal Forwarder), add the following lines to props.conf:

[WinEventLog:Application]
TRANSFORMS-filter = filter_information
[WinEventLog:Security]
TRANSFORMS-filter = filter_information
[WinEventLog:System]
TRANSFORMS-filter = filter_information

WinEventLog:Application, WinEventLog:Security and WinEventLog:System refer to the sourcetypes.

And add the following lines to transforms.conf:

[filter_information]
REGEX = Type=Information
DEST_KEY = queue
FORMAT = nullQueue

Do not forget to restart Splunk after making these changes.

View solution in original post

whrg
Motivator

Hello @crsupportddc,

So I assume the Windows events (which are multiline) contain this line which you want to base your filter on:

Type=Information

Check out this page on how to filter specific events: Discard specific events and keep the rest.

On your heavy forwarder/indexer (whatever system comes after the Universal Forwarder), add the following lines to props.conf:

[WinEventLog:Application]
TRANSFORMS-filter = filter_information
[WinEventLog:Security]
TRANSFORMS-filter = filter_information
[WinEventLog:System]
TRANSFORMS-filter = filter_information

WinEventLog:Application, WinEventLog:Security and WinEventLog:System refer to the sourcetypes.

And add the following lines to transforms.conf:

[filter_information]
REGEX = Type=Information
DEST_KEY = queue
FORMAT = nullQueue

Do not forget to restart Splunk after making these changes.

crsupportddc
Explorer

Thank you for the help.
I managed to create a blacklist and avoid some specific logs but I'll implement what you mentioned to completely ignore the Information logs.

whrg
Motivator

Filtering by blacklisting specific EventCodes works as well. Good thinking.

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...