Windows Event Filtering working on all but one host.

[dsg18096]

This is a weird situation. I have on a number of Windows hosts running the heavyweight forwarder the following in local\props.conf

[WinEventLog:Security]
TRANSFORMS-null = setnull

and in local\transforms.conf

[setnull]
REGEX = (?msi)^EventCode=(5152|5157)\b
DEST_KEY = queue
FORMAT = nullQueue

That's been in place for about six months and was working as expected across all hosts (we did not see those codes in the indexer). A couple months ago, one host was rebuilt and inadvertently, the windows app was not installed. Recently we had a flood of the above two events, plus another, 5447, from that particular host. I updated transforms.conf to add the 5447 event (propgated to all other hosts) and added the windows app to the one that was missing it (and restarted splunk all around). All the other hosts are behaving as expected. That one host is still sending the 5152, 5157 and 5447 events. I've gone so far as to remove and reinstall splunk on it but it's still sending them. What could be going wrong?

[dwaddle]

This is strange. Are you sure it's the heavy forwarder app that is enabled, and not the Light Forwarder app? Are both perhaps enabled? It sounds like this forwarder isn't doing parsing, because the same config works on all of the others.

You might try putting this same props / transforms setup on your indexers, and see if that filters these away.

[dwaddle]

No it doesn't. The daily license volume only counts things which make it into the index proper. If you route it to a nullQueue at the indexer, then it doesn't count against you.

[dsg18096]

It's definitely the heavy forwarder, and there's no conflicting light forwarder on the system.

I suppose I can try putting the filter on the indexer, but even if I do, does that have any affect on my volume limit?