Getting Data In

Multiple WMI sources in PROPS.conf

philliphyatt
New Member

Complete newb here, any help appreciated!

props.conf
[WMI:WinEventLog:Security]
TRANSFORMS-set= setnulla,parse2003secevents,parse2008secevents

[WMI:WinEventLog:System]
TRANSFORMS-set= setnullb,parse2003sysevents,parse2008sysevents

Transforms.conf
[setnulla]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue

[parse2003secevents]
REGEX =(?msi)^EventCode=(xxx|xxx)\b
DEST_KEY = queue
FORMAT = indexQueue

[parse2008secevents]
REGEX =(?msi)^EventCode=(xxxx|xxxx)\b
DEST_KEY = queue
FORMAT = indexQueue

[setnullb]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue

[parse2003sysevents]
REGEX =(?msi)^EventCode=(xxx|xxx)\b
DEST_KEY = queue
FORMAT = indexQueue

[parse2008sysevents]
REGEX =(?msi)^EventCode=(xxxx|xxxx)\b
DEST_KEY = queue
FORMAT = indexQueue

Tags (2)
0 Karma

tgow
Splunk Employee
Splunk Employee

As a general rule it is better to configure Splunk to filter out what you don't want and leave the rest to be indexed. The first issue I see is the the "REGEX = ." which means to send all of the data into the null queue. This is a great method to test if the transforms is working but not a good idea. So I am assuming that you want to only filter certain EventCodes from being indexed.

props.conf
[WMI:WinEventLog:Security]
TRANSFORMS-set= setnulla,

transforms.conf
REGEX =(?msi)^EventCode=(4756|4775)
DEST_KEY = queue
FORMAT = nullQueue

This props/transforms combination will not index any EventCode of 4756 or 4775 but all other events will be indexed.

0 Karma

philliphyatt
New Member

Thanks for the response but my intent is to drop everything but the event codes in the [parse] statements. Sorry I guess I should have clarified.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...