Is there any way to get only critical and error logs from Windows?
I mean, Windows generates logs using different levels (Critical, Warning, Error, Information...) and I don't want the Information logs on Splunk, so I would like to configure the forwarder to not send them.
So I assume the Windows events (which are multiline) contain this line which you want to base your filter on:
Check out this page on how to filter specific events: Discard specific events and keep the rest.
On your heavy forwarder/indexer (whatever system comes after the Universal Forwarder), add the following lines to props.conf:
[WinEventLog:Application] TRANSFORMS-filter = filter_information [WinEventLog:Security] TRANSFORMS-filter = filter_information [WinEventLog:System] TRANSFORMS-filter = filter_information
WinEventLog:Application, WinEventLog:Security and WinEventLog:System refer to the sourcetypes.
And add the following lines to transforms.conf:
[filter_information] REGEX = Type=Information DEST_KEY = queue FORMAT = nullQueue
Do not forget to restart Splunk after making these changes.
Thank you for the help.
I managed to create a blacklist and avoid some specific logs but I'll implement what you mentioned to completely ignore the Information logs.