Hello everyone, I´m trying to filter some Windows Security Event Logs that contains the machine name as the username. To do this I created the props.conf and transforms.conf files as below at the Windows machines where I've installed Splunk Forwarder. (/etc/system/local and /etc/apps/Splunk_TA_Windows/local). props.conf [WinEventLog:Security] TRANSFORMS-null = setnull transforms.conf [setnull] REGEX = (?ms)EventCode=(5145|4634|4624|5140|4625|4648|4661|4662|4672|4771|4611)(.*Security ID:.*\$).*Account.* DEST_KEY = queue FORMAT = nullQueue Is there any errors at my regex? Do I have to do something else? I already put the files at the indexer too but I am still getting events. Best Regards, Caroline Fortunato ... View more

Hello, I installed splunk universal forwarder and the Exchange2010-Mailbox app to collect Exchange Auditing data. I noticed that every time Splunk executes the exchange script it´s getting the data over and over again. The data is being duplicated. Is there anything I did wrong? I just installed Universal Forwarder and copied the Exchange add on folder inside splunk app folder. Regards, Caroline Fortunato ... View more