Getting Data In

nullQueue for Windows event codes not working

ebailey
Communicator

Hello,

I am trying to setup a nullQueue for Windows security events we do not care to index into Splunk and my configuration is not working. I am using the below on the Indexer and restarted Splunk. I do not see any errors and I am not sure how else to troubleshoot the issue. The sourcetype in the props matches the sourcetype of the data. Any feedback is most appreciated.

props.conf

[WinEventLog:Security]
TRANSFORMS-WinEvents=eliminate-eventcodes

transforms.conf

[eliminate-eventcodes]
REGEX = EventCode=(5156|4656|33205|5158|577|578|5157|5145|4769|4768|5145|4634)
DEST_KEY = queue
FORMAT = nullQueue

0 Karma

masonmorales
Influencer

Try...

props.conf

[WinEventLog:Security]
TRANSFORMS-DiscardWinEvents = eliminate-eventcodes

transforms.conf

[eliminate-eventcodes]
REGEX = (?m)^EventCode=(5156|4656|33205|5158|577|578|5157|5145|4769|4768|5145|4634)
DEST_KEY = queue
FORMAT = nullQueue

You'll need to restart your indexer again after making the change.

0 Karma

ebailey
Communicator

No joy - I made the change and then restarted splunkd. The events are still being indexed. I have other data getting dumped to nullqeueu so this not working is confusing.

0 Karma

yannK
Splunk Employee
Splunk Employee

if you are using an Universal/Lightweight forwarder, then the nullQueue props/transforms have to be on the indexers.
But if you re using heavy forwarders (HF), you need to put the props/transforms have to to be on the HF.

otherwise since splunk 5, you can filter evencodes directly on the forwarders in the inputs.con (look for blacklist under WinEventcode)

0 Karma

ebailey
Communicator

the settings are on the indexers - I am working with support on the issue - Thanks for the suggestions

0 Karma

masonmorales
Influencer

Could email me a ./splunk diag from your forwarder and your indexer? (See e-mail address in my portfolio)

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...