Windows 2008 event filtering

[rriley]

Trying to throw away events not wanted from a server - not working.

props.conf
[WinEventLog:Security]
TRANSFORMS-null = setnull

transform.conf
[setnull]
REGEX = (?m)^EventCode=(4658|4662|4689|4768|4769|4770|4771|4776|4931|4932|4933|4985|5136|5156)\D
DEST_KEY = queue
FORMAT = nullQueue

also tried:
REGEX = (?m)^EventCode=(4658|4662|4689|4768|4769|4770|4771|4776|4931|4932|4933|4985|5136|5156)\b

Any ideas?

Maybe this will be better than a support ticket - that takes forever to get an answer.

[yannK]

Where are those props/transforms applied ?

They have to be where the events are parsed : on the indexer or on heavy forwarders, not on the Universal or Light Forwarders.

[rriley]

Sorry this is the config of a full splunk install set to forward. Not a light forwarder.

[rriley]

for some reason the (Backslash)\ was omitted when I pasted:

REGEX = (?m)^EventCode=(4658|4662|4689|4768|4769|4770|4771|4776|4931|4932|4933|4985|5136|5156)(backslash)\D

and
REGEX = (?m)^EventCode=(4658|4662|4689|4768|4769|4770|4771|4776|4931|4932|4933|4985|5136|5156)(backslash)\b

[Starlette]

did you try this without the (backslash)D ?