Splunk Search

I think I have a problem with my Splunk Indexer filter. What is the best way to troubleshoot?

Engager

Hi! I am trying to setup filtering on my Splunk server that is receiving events from the Splunk universal forwarder on a Windows 2008r2 server. The universal forwarder is configured to only forward security events and was doing so correctly.

I created /opt/splunk/etc/system/local/props.conf

[WinEventLog:Security]
TRANSFORMS-set= setnull

And /opt/splunk/etc/system/local/transforms.conf

[setnull]
REGEX = (?msi)^EventCode=(?!(515|463|462|476)\b)
DEST_KEY = queue
FORMAT = nullQueue

I found http://splunk-base.splunk.com/answers/37593/filter-events-on-indexer and based the filter off of that, but now that I have enabled the above configuration no alerts are coming through at all. Splunk hasn't indexed any events for over an hour now. I would think that I should still be receiving EventCode=4663's (for example.)

Can anyone please tell me what I am doing wrong? Thanks!

0 Karma
1 Solution

Champion

I am assuming that props.conf and transforms.conf are set on you indexer no your UF. I don't think that regex is doing what you want it to do. I tested your regex and it matches EventCode=, causing most events to be sent to null. Everything in your conf files seems to be on the up and up. Below are some variant that work


(?msi)^EventCode=(515|463|462|476|4663)\b
(?msi)^EventCode=(515|463|462|476|4663)
EventCode=(515|463|462|476|4663)

You may want to read Regex Advance.

Hope this helps you or gets you started. Don't forget to vote and accept answer if they help.

View solution in original post

Champion

I am assuming that props.conf and transforms.conf are set on you indexer no your UF. I don't think that regex is doing what you want it to do. I tested your regex and it matches EventCode=, causing most events to be sent to null. Everything in your conf files seems to be on the up and up. Below are some variant that work


(?msi)^EventCode=(515|463|462|476|4663)\b
(?msi)^EventCode=(515|463|462|476|4663)
EventCode=(515|463|462|476|4663)

You may want to read Regex Advance.

Hope this helps you or gets you started. Don't forget to vote and accept answer if they help.

View solution in original post

Engager

Hey bmacias84!

Thank you for the assistance! I ended up using and adding to the second regex that you listed and so far so good! I will definitely check out the Regex Advance link you provided.

edit: Yes, the .conf files are on my indexer

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!