Trying to drop Windows Events at the Indexer

[rmcdougal]

I am attempting to drop WinEventLog:Security EventCode's at the Indexer and I am not having any success. I have read a few SplunkBase questions concerning this very topic and attempted to follow the instructions with little success. This is what I have so far.

Props.conf


[WinEventLog:Security]
TRANSFORMS-set = dropevents


Transforms.conf


[dropevents]
REGEX = (?m)^EventCode=(4957|5154|5156|5158)
DEST_KEY = queue
FORMAT = nullQueue


Any ideas what I am doing wrong here?

[Chubbybunny · Accepted solution]

we do it like this on our bunny farm:

$SPLUNK_HOME/etc/system/local:
Props.conf

 [WinEventLog:Security]
 TRANSFORMS = null, keep

Transforms.conf

[keep]
REGEX = .
DEST_KEY = queue
FORMAT = indexQueue

[null]
REGEX=EventCode=(4957|5154|5156|5158)
DEST_KEY = queue
FORMAT = nullQueue

[rmcdougal]

Interestingly enough, even if I do this

props.conf


[WinEventLog:Security]
TRANSFORMS = setnull


transforms.conf


[setnull]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue


It doesn't drop anything. It has to be something with the sourcetype having a colon in it I imagine.

[sowings]

The location of the props.conf or transforms.conf matters. If this is a Universal Forwarder (UF), the rules which would trigger for placing these events in the nullQueue aren't processed there. You'll need these rules on the indexer(s) instead. By contrast, if the forwarder is "heavy" (i.e. a full Splunk forwarding its log data elsewhere), the props / transforms have to be on that forwarder itself.

[rmcdougal]

I appreciate the help, but for some reason this still isn't working for me. This is what I have on my box currently but is still isn't dropping anything.

props.conf

[WinEventLog:Security]
TRANSFORMS-set= setnull,setparsing

transforms.conf


[setnull]
REGEX = EventCode=(4957|5154|5156|5158)
DEST_KEY = queue
FORMAT = nullQueue

[setparsing]
REGEX = .
DEST_KEY = queue
FORMAT = indexQueue

Here is a sample event

http://i.imgur.com/FmxeK.png

[Chubbybunny]

Vote the Chubby bunny up if it helps!

(\__/)
(='.'=)
(")_(")