Why is the Index Filter is not working?

[ntripp_element]

I have a filter built from: http://docs.splunk.com/Documentation/Splunk/7.0.2/Forwarding/Routeandfilterdatad and https://www.splunk.com/blog/2012/09/21/the-splunk-app-for-active-directory-and-how-i-tamed-the-secur...

transforms.conf
[dumpFirewallEvents]
REGEX=(?m)EventCode=(5156|5157)
DEST_KEY = queue
FORMAT=nullQueue

props.conf
[source::wineventlog:security] TRANSFORMS-firewall = dumpFirewallEvents

I'm stilling seeing the events 5156 in splunk and it's flooding the index quota

[gcusello · Accepted solution]

Hi ntripp_element,
at a first sight, I see an error in your regex: = is a special char that you must escape with backslash "\"

REGEX=(?m)EventCode\=5156|5157

Anyway I usually prefer to use two transforms:
in props.conf

[WinEventLog:Security]
TRANSFORMS-set= setparsing,setnull

in transforms.conf

[setnull]
REGEX = (?m)EventCode\=(5156|5157)
DEST_KEY = queue
FORMAT = nullQueue
[setparsing]
REGEX = .
DEST_KEY = queue
FORMAT = indexQueue

Bye.
Giuseppe

[somesoni2]

If you're using Splunk 6 or above at your forwarder level, you can/should do filter of Windows Event logs at forwarder level using blacklist attribute in the monitoring stanza. See this

http://docs.splunk.com/Documentation/Splunk/7.0.2/Data/MonitorWindowseventlogdata#Create_advanced_fi...

[ntripp_element]

I tried that too as below:

[default]
host =

[script://$SPLUNK_HOME\bin\scripts\splunk-wmi.path]
disabled = 0

[WinEventLog://Security]
disabled = 0
start_from = oldest
blacklist = 5156-5157

Also not working

[somesoni2]

So you're adding above inputs.conf entry in the Windows server where you're collecting Windows Event logs from? Did you restart Splunk service after making the change?

[ntripp_element]

I'm using the universal forwarder to the splunk indexer. I placed those settings into inputs.conf on the indexer and restarted the service.