Hi! I am trying to setup filtering on my Splunk server that is receiving events from the Splunk universal forwarder on a Windows 2008r2 server. The universal forwarder is configured to only forward security events and was doing so correctly.
I created /opt/splunk/etc/system/local/props.conf
[WinEventLog:Security] TRANSFORMS-set= setnull
[setnull] REGEX = (?msi)^EventCode=(?!(515|463|462|476)\b) DEST_KEY = queue FORMAT = nullQueue
I found http://splunk-base.splunk.com/answers/37593/filter-events-on-indexer and based the filter off of that, but now that I have enabled the above configuration no alerts are coming through at all. Splunk hasn't indexed any events for over an hour now. I would think that I should still be receiving EventCode=4663's (for example.)
Can anyone please tell me what I am doing wrong? Thanks!
I am assuming that props.conf and transforms.conf are set on you indexer no your UF. I don't think that regex is doing what you want it to do. I tested your regex and it matches EventCode=, causing most events to be sent to null. Everything in your conf files seems to be on the up and up. Below are some variant that work
You may want to read Regex Advance.
Hope this helps you or gets you started. Don't forget to vote and accept answer if they help.
Thank you for the assistance! I ended up using and adding to the second regex that you listed and so far so good! I will definitely check out the Regex Advance link you provided.
edit: Yes, the .conf files are on my indexer