discard not needed events

[Clovens]

Hi,
I am new to splunk, I only want to forward specific events to splunk (for example: failures)and discard the rest.In the props.conf file
I added these lines below
[WMI:WinEventLog:Security]
TRANSFORMS-wmi=wminull

and in the transforms.conf file, I added those lines
[wminull]
REGEX=(?m)^Keywords = Audit Success
DEST_KEY=queue
FORMAT=nullQueue

the indexer is still receiving the Audit Success logs, would you please let me know what I am doing wrong?

thanks,.

[mloven_splunk]

Clovens,

Another possibility is that that beginning of line character may not actually be there. Try it with just Audit Success and see what happens.

Also, the things that Ayn mentioned. Make sure those are correct first.

[Clovens]

I made the changes but the indexer is still collecting the data,
I even tried using the eventype but that didn't work either.

[EventType]
REGEX=(?m)Type=Information
DEST_KEY=queue
FORMAT=nullQueue

below is one of the events that I want to discard

LogName=Security
SourceName=Microsoft Windows securityauditing.
EventCode=5156
EventType=0
Type=Information
ComputerName=Computer.domain.inc
TaskCategory=Filtering Platform Connection
OpCode=Info
RecordNumber=711139664
Keywords=Audit Success
Message=The Windows Filtering Platform has allowed a connection.

would you please take a look, thanks.

[Ayn · Accepted solution]

Two possible causes to this:
- You're trying to do this on a Universal Forwarder. These will not filter data - it has to be done on the indexer.
- Your regex isn't matching properly.