Newbie Question on nullQueue

[millerjc123]

Hello Everyone,

I know there are questions similar to mine, but I cannot seem to transform them into a solution for my problem. I am trying to dump information event logs to the nullQueue so they do not count against the cap (company still deciding if they want Splunk). What I currently have is (sorry if new lines are messed up):

transforms.conf:

[RemoveInformation]

REGEX=(?m)Type\s*=\s*Information

DEST_KEY = queue

FORMAT = nullQueue

props.conf:

[WMI:WinEventLog:Application]

TRANSFORMS-wmi= RemoveInformation

[WMI:WinEventLog:Security]

TRANSFORMS-wmi= RemoveInformation

[WMI:WinEventLog:System]

TRANSFORMS-wmi= RemoveInformation

[WMI:WinEventLog:Setup]

TRANSFORMS-wmi= RemoveInformation

I don't believe it matters, but I am using windows based universal forwarder back to a debian based splunk server.

Thank you for any and all suggestions.

[starcher]

There there is why it is not applying the regex. You have to match the sourcetype.
[WMI:WinEventLog:Security]
TRANSFORMS-wmi= RemoveInformation

Needs to be
[WinEventLog:Security]
TRANSFORMS-WinSecRemove= RemoveInformation

[starcher]

A couple of questions. Are you collecting the logs via wmi? If not then the soucetypes will technically be different and not apply your null queue transform. Next question. Are you using dedicated indexers? If so anything with TRANSFORMS is an index time action and that config must be on each of your indexers not your search head to work.

[millerjc123]

We originally turned them off since it set off the daily limit. We now have (in C:\Program Files\SplunkUniversalForwarder\etc\system\local\inputs.conf):

[WinEventLog:Application]
disabled = 0
[WinEventLog:Security]
disabled = 0
[WinEventLog:System]
disabled = 0
[WinEventLog:Setup]
disabled = 0

Enable Service Logs

[WinEventLog:]
disabled = 0
start_from = oldest
current_only = 0
[WinEventLog: Services]
disabled = 0
start_from = oldest
current_only = 0

[starcher]

How are you telling the splunk forwarder to pickup the windows logs? Are you using the Windows TA? Or did you create your own inputs.conf?

[millerjc123]

Thank you for taking an interest.

We are using universal forwarders on the windows boxes to send the information back to a Linux ran Splunk instance. I believe that means we are not going wmi (since the splunk server isn't pulling the logs itself). Do you know what I should use in its place? I was also under the impression that universal forwarders cannot do this filter themselves, but my boss was potentially told something else?

Single server Splunk at this time (ignoring the universal forwarders).