How to filter Windows event logs on a Splunk 6.2.3 forwarder?

[vad34]

Hello

How do I filter events (Windows event log) on a forwarder? btw how do I install a heavy forwarder?
I have Splunk 6.2.3.

tnx in advance

[javiergn]

See this and scroll down to the attribution_link description.
You can use all the non-enterprise apps with your free license so this is not the problem. Have you changed anything at all in the default directory?

Whatever it is, try to restore it to what it was before so that we can focus in one problem at a time, otherwise it's going to be impossible to find out what's going on.

With regards to my other questions above, did you manage to take a look?

[javiergn]

In fact, it might be easier to remove the Windows Infra app until your event log reading problem is solved.

This is a complex app that requires proper planning before deploying and might be having an undesired side effect.

[esix_splunk]

Full Splunk and a HF are the same instance. The only difference is that a HF is configured not for indexing, but forwarding events upstream to the indexing tier. An HF is also required for some type of Splunk Apps and modular inputs such as DBX, Sourcefire, AWS etc.

[vad34]

Hello again,
I have configured heavy forwarder and have specified other Splunk instance to forward data .
I also configured in inputs.conf -Windows system events - whitelist & blacklist , but I am still able to see that other events coming to splunk and filtering isn't working.
Can u pls assist ?
Tnx in advance

[vad34]

Anyone? ...

[javiergn]

Can you paste your inputs.conf stanza here?

[vad34]

Sure ,
[default]
host = splunk-102
[splunktcp://9997]
[WinEventLog:System]
disabled = 0

only index events with these event IDs.

whitelist = 7036-7037

exclude these event IDs from being indexed.

blacklist = 0-7035,7037-10000
[WinEventLog:Security]
disabled = 0
current_only=1
blacklist1=EventCode="4726"

the same stanza appears in /opt/splunk/etc/apps/splunk_app_windows_infrastructure and in /opt/splunk/etc/apps/Splunk_TA_windows

[javiergn]

Hi, I've fixed several typos in your config. Try the following on your wineventlog section:

[WinEventLog://System]
disabled = 0
whitelist = 7036-7037
# Blacklist not needed based on the whitelist defined above

[WinEventLog://Security]
disabled = 0
current_only = 1
# Collect everything but the below
blacklist = 4726

[javiergn]

And don't forget to restart your splunk service of course.

[vad34]

corrected it and restart the splunk service but still getting the event 4726

[javiergn]

Is the whitelist on your System log stanza working at least?

[javiergn]

Try the following too that uses advanced filtering. There seems to be some issues on certain versions with blacklists, see this post.

[WinEventLog://System]
disabled = 0
whitelist = 7036-7037
# Blacklist not needed based on the whitelist defined above

[WinEventLog://Security]
disabled = 0
current_only = 1
# Collect everything but the below
blacklist1=EventCode=”4726”

[vad34]

still the same 😞

[vad34]

still the same (

[vad34]

yes, i see the event in splunk (event id 7036)

[vad34]

Tnx for quick reply,
I am unable to see how to download HF , only UF can be downloaded...

[javiergn]

UF is a different installer. Everything else comes from the same one. Simply download Splunk Enterprise and configure it to behave like a HF following the instructions I mentioned above.

[vad34]

thanks a lot