How to filter Windows event logs from a Universal Forwarder

[mokeefe]

Using 5.0.2. I am receiving Windows Event Logs at the Indexer from Universal Forwarders on Windows servers. I want to filter out or send to a null queue uninteresting Windows events, so I only see Error, Warning and Critical events.

I know this needs to be in the props.conf and transforms.conf but can't get it to work.

[Lowell]

Check out new Windows Event Log capabilities in Splunk 6.1:

http://blogs.splunk.com/2014/05/23/controlling-4662-messages-in-the-windows-security-event-log/

[mokeefe]

Yes, I know I can't do it at the UF, but I want to drop the events on the Indexer before they get indexed.

Thanks

[Ayn]

You cannot filter events on a Universal Forwarder. Event filtering can only occur on Splunk instances that perform parsing, which Universal Forwarder doesn't (and can't) do. You need to either setup filtering on the indexer, or switch to a heavy forwarder instead of a Universal Forwarder.

[Ayn]

Your question title announces the question is regarding filtering the events on a UF, so...

If you want help with the specific details you need to provide us with more information than that it "didn't work" - it's impossible to know exactly what you tried and what the exact result was. General info on event filtering is available here: http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Routeandfilterdatad#Keep_specific_events_a...

[mokeefe]

Yes, I know I can't do it at the UF, but I want to drop the events on the Indexer before they get indexed.

Thanks