Getting Data In

how to filter event logs by type?

jcrews
Engager

I've setup up event log monitoring on a few machines. I don't need to index and monitor anything but warnings and errors... These account for a tiny amount of what I'm indexing now. I know I can use black/whitelist for file names, but I haven't figured out how to ignore events by type. Is this possible? I imagine someone else is in a similar situation....

0 Karma

yannK
Splunk Employee
Splunk Employee

You can use a nullQueue filter to filter at index time on the indexers. Based on a regex over the events.

see http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad#Discard_specific_e...

for WinEventLog, you can use whitelist/blacklist on the EventCode on the forwarders
see http://docs.splunk.com/Documentation/Splunk/latest/Data/MonitorWindowsdata#Create_advanced_filters_w...

jcrews
Engager

these are helpful... I've read through them both. What I'm trying to do is not burn space saving a million "information events" instead of warnings and errors... I see I can filter by event code, but that list is too long reaching to black/white list it all... If I can pull the data and see the type in it's own field, you'd think I could actually filter by type?

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...