Getting Data In

Windows Event Filtering working on all but one host.

dsg18096
New Member

This is a weird situation. I have on a number of Windows hosts running the heavyweight forwarder the following in local\props.conf

[WinEventLog:Security]
TRANSFORMS-null = setnull

and in local\transforms.conf

[setnull]
REGEX = (?msi)^EventCode=(5152|5157)\b
DEST_KEY = queue
FORMAT = nullQueue

That's been in place for about six months and was working as expected across all hosts (we did not see those codes in the indexer). A couple months ago, one host was rebuilt and inadvertently, the windows app was not installed. Recently we had a flood of the above two events, plus another, 5447, from that particular host. I updated transforms.conf to add the 5447 event (propgated to all other hosts) and added the windows app to the one that was missing it (and restarted splunk all around). All the other hosts are behaving as expected. That one host is still sending the 5152, 5157 and 5447 events. I've gone so far as to remove and reinstall splunk on it but it's still sending them. What could be going wrong?

0 Karma

dwaddle
SplunkTrust
SplunkTrust

This is strange. Are you sure it's the heavy forwarder app that is enabled, and not the Light Forwarder app? Are both perhaps enabled? It sounds like this forwarder isn't doing parsing, because the same config works on all of the others.

You might try putting this same props / transforms setup on your indexers, and see if that filters these away.

0 Karma

dwaddle
SplunkTrust
SplunkTrust

No it doesn't. The daily license volume only counts things which make it into the index proper. If you route it to a nullQueue at the indexer, then it doesn't count against you.

0 Karma

dsg18096
New Member

It's definitely the heavy forwarder, and there's no conflicting light forwarder on the system.

I suppose I can try putting the filter on the indexer, but even if I do, does that have any affect on my volume limit?

0 Karma
Get Updates on the Splunk Community!

New Splunk Observability innovations: Deeper visibility and smarter alerting to ...

You asked, we delivered. Splunk Observability Cloud has several new innovations giving you deeper visibility ...

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...