Getting Data In
Highlighted

How to filter Windows event logs from a Universal Forwarder

New Member

Using 5.0.2. I am receiving Windows Event Logs at the Indexer from Universal Forwarders on Windows servers. I want to filter out or send to a null queue uninteresting Windows events, so I only see Error, Warning and Critical events.

I know this needs to be in the props.conf and transforms.conf but can't get it to work.

0 Karma
Highlighted

Re: How to filter Windows event logs from a Universal Forwarder

Legend

You cannot filter events on a Universal Forwarder. Event filtering can only occur on Splunk instances that perform parsing, which Universal Forwarder doesn't (and can't) do. You need to either setup filtering on the indexer, or switch to a heavy forwarder instead of a Universal Forwarder.

Highlighted

Re: How to filter Windows event logs from a Universal Forwarder

New Member

Yes, I know I can't do it at the UF, but I want to drop the events on the Indexer before they get indexed.

Thanks

0 Karma
Highlighted

Re: How to filter Windows event logs from a Universal Forwarder

Legend

Your question title announces the question is regarding filtering the events on a UF, so...

If you want help with the specific details you need to provide us with more information than that it "didn't work" - it's impossible to know exactly what you tried and what the exact result was. General info on event filtering is available here: http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Routeandfilterdatad#Keep_specific_events_a...

Highlighted

Re: How to filter Windows event logs from a Universal Forwarder

New Member

Yes, I know I can't do it at the UF, but I want to drop the events on the Indexer before they get indexed.

Thanks

0 Karma
Highlighted

Re: How to filter Windows event logs from a Universal Forwarder

Super Champion