Splunk Search
Highlighted

I think I have a problem with my Splunk Indexer filter. What is the best way to troubleshoot?

Engager

Hi! I am trying to setup filtering on my Splunk server that is receiving events from the Splunk universal forwarder on a Windows 2008r2 server. The universal forwarder is configured to only forward security events and was doing so correctly.

I created /opt/splunk/etc/system/local/props.conf

[WinEventLog:Security]
TRANSFORMS-set= setnull

And /opt/splunk/etc/system/local/transforms.conf

[setnull]
REGEX = (?msi)^EventCode=(?!(515|463|462|476)\b)
DEST_KEY = queue
FORMAT = nullQueue

I found http://splunk-base.splunk.com/answers/37593/filter-events-on-indexer and based the filter off of that, but now that I have enabled the above configuration no alerts are coming through at all. Splunk hasn't indexed any events for over an hour now. I would think that I should still be receiving EventCode=4663's (for example.)

Can anyone please tell me what I am doing wrong? Thanks!

0 Karma
Highlighted

Re: I think I have a problem with my Splunk Indexer filter. What is the best way to troubleshoot?

Champion

I am assuming that props.conf and transforms.conf are set on you indexer no your UF. I don't think that regex is doing what you want it to do. I tested your regex and it matches EventCode=, causing most events to be sent to null. Everything in your conf files seems to be on the up and up. Below are some variant that work


(?msi)^EventCode=(515|463|462|476|4663)\b
(?msi)^EventCode=(515|463|462|476|4663)
EventCode=(515|463|462|476|4663)

You may want to read Regex Advance.

Hope this helps you or gets you started. Don't forget to vote and accept answer if they help.

View solution in original post

Highlighted

Re: I think I have a problem with my Splunk Indexer filter. What is the best way to troubleshoot?

Engager

Hey bmacias84!

Thank you for the assistance! I ended up using and adding to the second regex that you listed and so far so good! I will definitely check out the Regex Advance link you provided.

edit: Yes, the .conf files are on my indexer

0 Karma