How to forward only specific Windows eventlogs via Splunk Universal forwarder

[chimbudp]

I need to monitor only logs with Event code = 5410,6913.
How can i setup this in forwarder ?
please suggest some help

[sbrant_splunk]

As of Splunk 6, there is a simpler way to filter which Windows events are forwarded by Splunk.

See whitelist and blacklist in the "Windows Event Log Monitor" section of the following doc: http://docs.splunk.com/Documentation/Splunk/latest/admin/Inputsconf

[lukejadamec · Accepted solution]

This is what the book says to do...

On the forwarder, you need to enable the WinEventLog:Security input.

On the indexer you need to create entries in your system/local/props.conf and system/local/transforms.conf

props.conf

[source::*:Security]

TRANSFORMS-set=setnull,setparsing

transforms.conf

[setnull]

REGEX = .

DEST_KEY = queue

FORMAT = nullQueue

[setparsing]

REGEX =(?m)^EventCode=(5410|6913)

DEST_KEY = queue

FORMAT = indexQueue

[kristian_kolb]

the docs are at

http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Routeandfilterdatad#Keep_specific_events_a...

/k