Hi, Trying to send all eventIDs from WinEventLog:Security to NullQueue with the exception of 592 and 593. Still getting all security events indexed :< props.conf and transforms.conf, located in Splunk\etc\system\local on the forwarder are as follows:
[setnull] REGEX = . DEST_KEY = queue FORMAT = nullQueue [setparsing] REGEX = (?m)^EventCode=(592|593) DEST_KEY = queue FORMAT = indexQueue
Hi, a couple things.
1) If you use a LightWeightForwarder, you might have to put those configurations on the indexer too.
2) Windows Security event logs have white spaces before "EventCode", so binding your regex to the start of the line should not work.
REGEX = (?m)EventCode=(592|593)
You could also do the same job with a simpler configuration, though:
[dropevents] REGEX = (?m)EventCode=(?!592|593) DEST_KEY = queue FORMAT = nullQueue
This regex means "discard everything that has EventCode different from either 592 or 593"