Getting Data In

Transforms.conf issue

nmccaffery333
Loves-to-Learn Lots

We're working with a 30 day trial as we wait for procurement to purchase a full license. While learning and configuring the system, I'm working on getting rid of some events we don't want to see. So far it's not working.

My first question is, will this work on a Trial license?

If it will, here's what my files looks like. I've tried as many combinations and formats as I can find examples for. I had the Transforms settings all in one stanza to start with, below is my latest attempt.
If I run "splunk btool check", I see no errors.
Help! Please .

 

props.conf:

[WinEventLog:Security]
TRANSFORMS-security = setnull0

[WMI:WinEventLog:System]
TRANSFORMS-wmisystem = setnull1

[WinEventLog:System]
TRANSFORMS-system = setnull2

 

transforms.conf:

[setnull0]
SOURCE_KEY = dest
REGEX = ^EventCode=(1107|4688|7036|10028)\D
DEST_KEY = queue
FORMAT = nullQueue

[setnull1]
SOURCE_KEY = dest
REGEX = ^EventCode=(1107|4688|7036|10028)\D
DEST_KEY = queue
FORMAT = nullQueue

[setnull2]
SOURCE_KEY = dest
REGEX = ^EventCode=(1107|4688|7036|10028)\D
DEST_KEY = queue
FORMAT = nullQueue

 

Labels (3)
0 Karma

nmccaffery333
Loves-to-Learn Lots

Here's and example event;

 

09/17/2020 12:10:53 PM
LogName=System
SourceName=Microsoft-Windows-Service Control Manager
EventCode=7036
EventType=4
Type=Information
ComputerName=oneof.my.servers
TaskCategory=None
OpCode=The operation completed successfully.
RecordNumber=15183030

0 Karma

nmccaffery333
Loves-to-Learn Lots

That makes sense, and I think I tried it before. I just tried it again and those events are still showing up.

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Yes, it will work with a trial license.

Try removing the ^ from the REGEX settings.  The existing settings will fail since the events do not begin with "EventCode".

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...