Windows log filtering

[Antonello1]

In my Splunk instance, logs are sent to the central instance via a universal forwarder and the deployment server has been enabled for the distribution of the different configurations to the various clients. For parsing windows logs the windows add-on is used which also provides a specific sourcetype.
The problem is that for Windows clients we are unable to filter authentication events for:
- Status (success/logoff/log failed) with EventCode:[4624->Logon success 4625->failure 4634->LogOff]
- Account name. That is, we want to filter the logs that contain a certain substring in account name with the regex (always defining it within the whitelist where the event filter for the various eventcodes indicated above is contained).
At present, events reach the master instance filtered only by eventcode rather than by eventcode and substring contained in the account name field. Could you help me?

[marnall]

You could put a props.conf and transforms.conf config on the indexer which looks for a regex match, and then puts all matches into the null queue, which removes them.

# put this stanza in props.conf
[yoursourcetype]
TRANSFORMS-anynamegoeshere=yourtransformname

# put this stanza in transforms.conf
[yourtransformname]
REGEX = <REGEX GOES HERE>
DEST_KEY = queue
FORMAT = nullQueue

I recommend making your regex as specific as possible, and replacing the "yoursourcetype" stanza name so that it applies to specifically the logs you would like to filter.

It may also be a good idea to start with a transform that moves the filtered events to another index, so that you can double-check that it is only moving the logs that you would like to filter out.

# Put this in transforms.conf if you would like to move the filtered logs to another index instead of delete them
[yourtransformname]
REGEX = <REGEX GOES HERE>
FORMAT = <dest index name>
DEST_KEY = _MetaData:Index