Windows Event Log Filter Attempt Failing

[jchensor]

Hello, everyone.

I've looked at the following pages in Splunk Answers already, but after following everything they've done in there, I still cannot get my situation to work. 😞 But I looked through these:

http://splunk-base.splunk.com/answers/577/how-do-you-filter-windows-event-log
http://splunk-base.splunk.com/answers/13093/remote-event-log-windows-filtering-by-eventcode-not-work...
http://splunk-base.splunk.com/answers/29218/filtering-windows-event-logs

So I basically have the same problem as the first link, but I can't get it to work, even with the techniques used in that issue. I want to filter out certain Windows Events by EventCode, but the settings don't seem to take. Here's my settings:

-- PROPS.CONF --

[WinEventLog:Security]
TRANSFORMS-wineventlog-security = wineventlog_security_setNull

-- TRANSFORMS.CONF --

[wineventlog_security_setNull]
REGEX = (?msi)^EventCode=4674\D
DEST_KEY = queue
FORMAT = nullQueue

I'm putting this on the Forwarder machine, as this occurs on the Forwarders, correct? Or should this be on the Indexers?

Thanks everyone!

• James

[yannK]

Additional method to filter since Splunk 6.*
http://answers.splunk.com/answers/116817/filter-wineventlog-events-based-on-the-eventcodes

[MuS · Accepted solution]

Hi jchensor

props.conf and transforms.conf are only handled on heavy forwarder and not on light or universal forwarder.

If your forwarder is s heavy, you could put props.conf and transforms.conf there.

If your forwarder is a light or universal forwarder, you must put your props.conf and transforms.conf on the indexer.

hope this helps

cheers,
MuS

[jchensor]

Ahhhh, yes. ^_^ Thanks. Moving it to the indexer made it work exactly as I wanted. Thanks so much!!