Universal Forwader Regex - no special field

[sdf5496d8f]

Hey Guys,

any chance to set a blacklist entry in the universal forwarders input.conf for not sending events where in any field (description, TargetUserName, TargetUserSid or any else) the name for example "ITUser*" exists?

[inventsekar]

i assume you would want to configure "Discard specific events and keep the rest" type events routing.
one example configuration i updated below.. for further reference on this topic-
http://docs.splunk.com/Documentation/Splunk/6.4.2/Forwarding/Routeandfilterdatad

Discard specific events and keep the rest
This example discards all sshd events in /var/log/messages by sending them to nullQueue:

1. In props.conf, set the TRANSFORMS-null attribute:

[source::/var/log/messages]
TRANSFORMS-null= setnull
2. Create a corresponding stanza in transforms.conf. Set DEST_KEY to "queue" and FORMAT to "nullQueue":

[setnull]
REGEX = [sshd]
DEST_KEY = queue
FORMAT = nullQueue
3. Restart Splunk Enterprise.

[Richfez · Accepted solution]

As you've seen, there are only certain things a Universal Forwarder can do to the data. Indeed, in Windows it's a special case that it can do more filtering than on other operating systems (at least with respect to Windows Event Logs).

The way to handle this is with routing and filtering on the indexer side of things.

So, by all means include any blacklist you can include on the UF, like entire Eventcodes and whatnot. That may be lots, that may be nothing. But then on the indexer(s) you'll follow the Splunk Docs on Routing and Filtering Data. You'll see I linked you right to the section you'll need. Your source will be whatever it's set to (search an existing event will tell) or you could filter on sourcetype.

Your regex - I'd test in regex101.com a bit but if the string ITUser won't happen anywhere except when you want to get rid of it, your REGEX could be REGEX = ITUser. All the rest should be the same as the example though for clarity you can change the name of the stanza.

Props .conf might have the line be:

[source::WinEventLog:Security]
TRANSFORMS-killITUser= RemoveITUser

Then the transforms.conf stanza would be

[RemoveITUser]
REGEX = ITUser
DEST_KEY = queue
FORMAT = nullQueue