- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Even after reading the documentation and a lot of posts here on answers, I just can't get filtering to work. I've recently installed two VM to test it out.
One indexer server and one universal forwarder. The configuration is being done in the Indexer since universal forwarder according to the docs doesn't do parsing.
REGEX is set to "." to test if the filtering is working.
SPLUNK\etc\system\local\props.conf
[WinEventLog:Security]
TRANSFORMS-setnull = setnull
SPLUNK\etc\system\local\transforms.conf
[setnull]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue
Isn't this configuration supposed to filter everything from WinEventLog:Security?
I get all the logs anyways.
Additional information that may be related:
http://answers.splunk.com/questions/13196/universal-forwarder-sending-cooked-data-to-indexer
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You have run into a known issue (SPL-38443) with the 4.2 Lightweight and Universal Forwarder.
The Windows 4.2 lightweight and universal forwarder parses WinEventLog datastreams on the forwarder, preventing all parsing control on the indexer.
The symptoms of this are: no filtering nor routing to the nullqueue based on props and transforms. WinEventLog data is bypassing props.conf and transforms.conf on the indexer.
The workaround would be to use a 4.2 full/regular forwarder or 4.1.x lightweight forwarder but this will be fixed for 4.2.1
http://www.splunk.com/base/Documentation/latest/ReleaseNotes/Knownissues
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You have run into a known issue (SPL-38443) with the 4.2 Lightweight and Universal Forwarder.
The Windows 4.2 lightweight and universal forwarder parses WinEventLog datastreams on the forwarder, preventing all parsing control on the indexer.
The symptoms of this are: no filtering nor routing to the nullqueue based on props and transforms. WinEventLog data is bypassing props.conf and transforms.conf on the indexer.
The workaround would be to use a 4.2 full/regular forwarder or 4.1.x lightweight forwarder but this will be fixed for 4.2.1
http://www.splunk.com/base/Documentation/latest/ReleaseNotes/Knownissues
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi Ellen,
is this really solved in 4.2.1 universal forwarder? I just ran into exactly this problem, that I was unable to redirect WinEventLog events no matter what transform I used. Only way to get them into different indexes was to set the index in inputs.conf on the 4.2.1 universal forwarder.
best regards, MuS
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I just installed the forwarder and only selected the security log in the wizard, nothing else.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
What does the input on the Universal Forwarder use to get data from the event logs?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I'm not using WMI to collect events, the source is always a universal forwarder.
