Getting Data In

How to handle Windows 2008 event log descriptive text with a universal forwarder

gpullis
Communicator

The crazily verbose descriptive text that's appended to the end of many Windows Server 2008 events has been covered in Splunk Answer Disabling or removing extra description text in Windows 2008 event logs?, with an excellent answer by jervin involving using SEDCMD in props.conf to trim the description off.

The problem is, per Configuration parameters and the data pipeline, a universal forwarder can't do a SEDCMD. It seems to me like you couldn't use a universal forwarder on a Windows 2008 server without absolutely murdering your Splunk license with all that descriptive text.

Can anyone think of a way around this problem?

1 Solution

jbsplunk
Splunk Employee
Splunk Employee

You could implement the configuration where the data is being parsed, most likely the indexer, and it would also alter the data in the same way.

View solution in original post

reedmohn
Communicator

What is the resource cost of doing this on the indexers? After all, in a Windows heavy environment, some of the events with these descriptions probably make up the bulk of logged security events.

Is there a way of doing it on an intermediary step? Ie. putting an intermediary forwarder between the Windows forwarders and the indexers?

0 Karma

rnagheereddy
Explorer

Make the forwarder a "Heavy Forwarder" and do the work before the data is sent to the Indexer. The tradeoff is that your forwarder will have higher CPU utilization.

I love the descriptive text when I'm scrolling through an actual event log, but I don't need to index or store ten gazillion copies of MSFT boilerplate in my Splunk db.

I'm literally in the middle of doing this so thanks for your link to the SEDCMD article!

0 Karma

jbsplunk
Splunk Employee
Splunk Employee

You could implement the configuration where the data is being parsed, most likely the indexer, and it would also alter the data in the same way.

ephemeric
Contributor

You can also do "sendCookedData = false" on the SUF and then work on the events on the indexer or heavy forwarder.

0 Karma

gpullis
Communicator

Thanks! Also, according to
http://splunk-base.splunk.com/answers/7171/sed-cmd-and-indexing-volume-count/7172

Since parsing happens before indexing, what SEDCMD chops off -- even on the indexer -- is not counted towards the license.

gpullis
Communicator

Correct, but then doesn't the unparsed data as it comes into the indexer count against my license?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...