I was able to successfully filter events using the lines below in props.conf and transform.conf. Has anyone filtered using another field of the same event? I want to filter by EventCode and Account_Name. We have one particular account that we expect to generate a high number of these events but we are interested in the others. Is this just a matter of modifying the same REGEX line?
Note: In pre-4.2.x versions of Splunk, you must use [wmi] as the sourcetype in order to send events to nullQueue.
[wminull] REGEX=(?m)^EventCode=(4662) DEST_KEY=queue FORMAT=nullQueue
Yes, when using transforms you can filter on anything you can match with regex. (this happens on your indexers unless you are using heavy forwarders)
Side note: in the scenario that you are only filtering based on the Windows code, see the following article on how to filter Windows codes directly on the Universal Forwarder.
Thanks for the feedback. I have a REGEX that should work but now it's not filtering any 4662 events so the REGEX is not matching anything in Splunk.
What am I missing? Anyone?
Please help me out how to create REGEX for the below list of event codes in transforms.conf
i want to index only this event code data to SPLUNK Cloud