Getting Data In

Transforms.conf issue

nmccaffery333
Loves-to-Learn Lots

We're working with a 30 day trial as we wait for procurement to purchase a full license. While learning and configuring the system, I'm working on getting rid of some events we don't want to see. So far it's not working.

My first question is, will this work on a Trial license?

If it will, here's what my files looks like. I've tried as many combinations and formats as I can find examples for. I had the Transforms settings all in one stanza to start with, below is my latest attempt.
If I run "splunk btool check", I see no errors.
Help! Please .

 

props.conf:

[WinEventLog:Security]
TRANSFORMS-security = setnull0

[WMI:WinEventLog:System]
TRANSFORMS-wmisystem = setnull1

[WinEventLog:System]
TRANSFORMS-system = setnull2

 

transforms.conf:

[setnull0]
SOURCE_KEY = dest
REGEX = ^EventCode=(1107|4688|7036|10028)\D
DEST_KEY = queue
FORMAT = nullQueue

[setnull1]
SOURCE_KEY = dest
REGEX = ^EventCode=(1107|4688|7036|10028)\D
DEST_KEY = queue
FORMAT = nullQueue

[setnull2]
SOURCE_KEY = dest
REGEX = ^EventCode=(1107|4688|7036|10028)\D
DEST_KEY = queue
FORMAT = nullQueue

 

Labels (3)
0 Karma

nmccaffery333
Loves-to-Learn Lots

Here's and example event;

 

09/17/2020 12:10:53 PM
LogName=System
SourceName=Microsoft-Windows-Service Control Manager
EventCode=7036
EventType=4
Type=Information
ComputerName=oneof.my.servers
TaskCategory=None
OpCode=The operation completed successfully.
RecordNumber=15183030

0 Karma

nmccaffery333
Loves-to-Learn Lots

That makes sense, and I think I tried it before. I just tried it again and those events are still showing up.

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Yes, it will work with a trial license.

Try removing the ^ from the REGEX settings.  The existing settings will fail since the events do not begin with "EventCode".

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...