Getting Data In

WMI filtering only eventlog from some users

Path Finder

I'm looking for a way to filter all the log eventlog from certain user's group (SYSTEM and Administrator), but all my test going bad 😞

(splunk 4.1.6)

prof.conf:

[wmi]
TRANSFORMS-wminull = wmi-null, wmi-parsing

transforms.conf

[wmi-null]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue  

[wmi-parsing]
REGEX = (?m)^User=(SYSTEM|Administrator)
DEST_KEY = queue
FORMAT = nullQueue
0 Karma

Contributor

pmelchiori,

It looks like you have the syntax mostly right, but you need to check a few things.

Is the sourcetype that you want to drop just "wmi" or is it "wmi:WinEventLog:Security" etc? Make sure this is explicit.

Additionally, your transform will apply to a SOURCE_KEY = _raw unless otherwise stated. Your _raw will probably be equal to the entire event. That would mean that the string "user=XXX" is NOT at the beginning of the event, and therefore you don't want the carat "^" in your regex.

Finally, you have two transforms, that do two different things. The top one has a REGEX = (.).
In Regex, a dot "." means match any single character. So, this will match anything and mark it all to the nullQueue. I am not sure your intention here, but you may want to adjust this or maybe even omit the first transform in lieu of the second.

Check the sourcetype, check your transforms, fix that in props.conf and then remove your carat and see how that goes.

Best,

Sean

Contributor

See my updated answer above.

0 Karma

Path Finder

Okay, I've made all the changes but it still archiving any log!

Switching the props.conf in wmi:WinEventLog:Security it stops working totally.

0 Karma

Motivator

did you try the followings:

REGEX = (.)

AND/OR

REGEX = (?msi)^User=(SYSTEM|Administrator)
0 Karma

Path Finder

Yes, it does't filter anything, I can see all the logs in Splunk.

0 Karma