I think I have a problem with my Splunk Indexer filter. What is the best way to troubleshoot?

[jringley]

Hi! I am trying to setup filtering on my Splunk server that is receiving events from the Splunk universal forwarder on a Windows 2008r2 server. The universal forwarder is configured to only forward security events and was doing so correctly.

I created /opt/splunk/etc/system/local/props.conf

[WinEventLog:Security]
TRANSFORMS-set= setnull

And /opt/splunk/etc/system/local/transforms.conf

[setnull]
REGEX = (?msi)^EventCode=(?!(515|463|462|476)\b)
DEST_KEY = queue
FORMAT = nullQueue

I found http://splunk-base.splunk.com/answers/37593/filter-events-on-indexer and based the filter off of that, but now that I have enabled the above configuration no alerts are coming through at all. Splunk hasn't indexed any events for over an hour now. I would think that I should still be receiving EventCode=4663's (for example.)

Can anyone please tell me what I am doing wrong? Thanks!

[bmacias84 · Accepted solution]

I am assuming that props.conf and transforms.conf are set on you indexer no your UF. I don't think that regex is doing what you want it to do. I tested your regex and it matches EventCode=, causing most events to be sent to null. Everything in your conf files seems to be on the up and up. Below are some variant that work

(?msi)^EventCode=(515|463|462|476|4663)\b

(?msi)^EventCode=(515|463|462|476|4663)

EventCode=(515|463|462|476|4663)

You may want to read Regex Advance.

Hope this helps you or gets you started. Don't forget to vote and accept answer if they help.

[jringley]

Hey bmacias84!

Thank you for the assistance! I ended up using and adding to the second regex that you listed and so far so good! I will definitely check out the Regex Advance link you provided.

edit: Yes, the .conf files are on my indexer