Getting Data In

Windows - Filtering Forwarded Events based on LogName

PickleRick
SplunkTrust
SplunkTrust

I have a use-case:

There is a WEC server receving logs from a server farm. I need to forward only security events from Forwarded Events Log. Judging from inputs.conf specs it should be enough to define an input such as:

 

[WinEventLog://ForwardedEvents]
current_only = 0
disabled = 0
index = whatever
renderXml = true
whitelist = LogName=Security

 

And this configuration should provide me with only security events forwarded from the source hosts being pulled by UF, right? The rest of Forwarder Events log should be left alone?

Labels (2)
0 Karma
1 Solution

venkatasri
SplunkTrust
SplunkTrust

Hi @PickleRick 

The config should work, if not see the regex format as described here - inputs.conf - Splunk Documentation

-----

An upvote would be appreciated if it helps!

View solution in original post

Tags (1)

venkatasri
SplunkTrust
SplunkTrust

I mean it only filters the Security events as you required. Docs says,

# Filtering at the input layer is desirable to reduce the total
# processing load in network transfer and computation on the Splunk platform
# nodes that acquire and processing Event Log data.

whitelist = <list of eventIDs> | key=regex [key=regex]

 

-----

An upvote would be appreciated if it helps!

Tags (2)

venkatasri
SplunkTrust
SplunkTrust

Hi @PickleRick 

The config should work, if not see the regex format as described here - inputs.conf - Splunk Documentation

-----

An upvote would be appreciated if it helps!

Tags (1)

PickleRick
SplunkTrust
SplunkTrust

Well, that's the regex format I'm using 😉

Thanks for confirming it should work. I'll test it before rolling out to prod anyway so I don't assume that something works and suddenly get surprised that it doesn't 😉

0 Karma

PickleRick
SplunkTrust
SplunkTrust

It seems that the syntax was almost OK.

The regex should be delimited, otherwise the UF throws an error into logs at startup and ignores the condition.

So it should say:

whitelist = LogName="Security"
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...