How to edit my props and transforms.conf on an indexer to filter out certain Windows event logs from being indexed?

[heathfbsw]

I am trying to filter out certain Windows Events before they are indexed. I need to do this at the indexer if at all possible. I have tried to follow guidelines posted at http://blogs.splunk.com/2012/09/21/the-splunk-app-for-active-directory-and-how-i-tamed-the-security-...
and I have attempted many things found here in Answers. It seems that no matter what I do, I still see the messages that I am trying to filter. I am currently testing with Event Code 4656.

Here is my current setup:
Windows host with Universal Forwarder -> Intermediate Forwarder (ubuntu with Splunk for Windows app) -> Indexer (ubuntu with Splunk for Windows app)

On the indexer I have created two files.
/opt/splunk/etc/apps/Splunk_TA_windows/local/props.conf and /opt/splunk/etc/apps/Splunk_TA_windows/local/transforms.conf
Here are their contents:
/opt/splunk/etc/apps/Splunk_TA_windows/local/props.conf:

[WinEventLog:Security]
TRANSFORMS-set = setnull

/opt/splunk/etc/apps/Splunk_TA_windows/local/transforms.conf:

[setnull]
REGEX = (?msi)EventCode=(5145|4656)
DEST_KEY = queue
FORMAT = nullQueue

Please point out my glaring mistakes. Thanks for any help you provide.

[somesoni2 · Accepted solution]

These configuration should be available in first full Splunk instance from the source. Since you're using Universal Frowarder, if your Intermediate Forwarder is full Splunk instance, then those configuration should be deployed there.

YOu should be able to filter events based on Event Codes directly on the Universal Forwarder inputs.conf. See this

https://answers.splunk.com/answers/152131/filter-windows-eventcode-using-blacklist-and-whitelist.htm...
http://blogs.splunk.com/2013/10/14/windows-event-logs-in-splunk-6/

[heathfbsw]

I figured out how to do what I wanted. I have the Universal Forwarder cloning data between two Receivers. One forwards all data on to syslog. The other filters the data and indexes.

Thanks for your response. Telling me that the config should be on the first full Splunk instance helped get me down the correct path.

[heathfbsw]

Thanks for the response.

I have been able to change the inputs.conf and blacklist the specific Event Codes in the past and it works very well, but the requirements around these Events have now changed. I am now required to store the Events long term. The solution that I am trying to push forward with is to have the Intermediate Forwarder to send to both a syslog server and the Splunk instance. This is working with the caveat that now Splunk gets the Events that I don't want as well. This is why I chose to deploy the filter at the Indexer.

Should I be able to filter these messages at the Indexer, or will it only work on the first full Splunk instance?

Thanks.