I am using universal forwarders installed on my domain controllers, and I am successfully filtering specific events (props.conf and transform.conf are show below). This is working as we want it to work, and the data is being indexed into "SecEvents". I want to add a new server and index into the same index (SecEvents); however, the list of event IDs are different. How can I filter from multiple sources? I've tried adding the host into the REGEX in the transform - but nothing I've tried works. For the sake of simplicity - let's just say I want events 1000 and 2000 from the "new server", and I want them to drop into the SecEvents index. Thanks for your help! Contents of props.conf [WinEventLog:Security] TRANSFORMS-security = events-null, events-filter Contents of transform.conf [events-null] REGEX = . DEST_KEY = queue FORMAT = nullQueue [events-filter] #The last 3...may generate a lot...watch for them REGEX=(?m)^EventCode=(4720|4722|4724|4725|4726|4727|4728|4729|4730|4731|4732|4733|4734|4735|4737|4740|4741|4743|4744|4745|4746|4747|4748|4749|4750|4751|4752|4753|4754|4755|4756|4757|4758|4759|4760|4761|4762|4763|4767|4771|4723|4625|6272|6273|6278) DEST_KEY = queue FORMAT = indexQueue ... View more

I am using Universal Forward to collect Windows Security logs from my Domain Controllers. All the logs were being dumped into the "default" (main) index, and we wanted to move to a new index. I created a new index called "windows". I changed the "c:\Program Files\SplunkUniversalForwarder\etc\system\local\inputs.conf" file on the DCs and modified as such: [default] host = DCHostName [WinEventLog://Security] index=windows I restarted the Universal Forwarder service. I confirmed that the new events are being written to the new index. That is working correctly. I wanted to move the "old" logs that has been written to the "main" index to the "windows" index, so I used this command: index=main AND sourcetype="WinEventLog:Security" | collect index=windows sourcetype="WinEventLog:Security" I verified that all the logs moved by comparing the count: (index=main OR index=windows) AND sourcetype="WinEventLog:Security" | stats count(EventCode) by index Since all the logs, moved, I deleted the logs from the main index" index=main AND sourcetype="WinEventLog:Security" | delete However, I discovered several of the fields are being parsed/index/identified correctly. For example, Account_Name is NULL, and Keywords is NULL for all of the logs that were moved from main index to windows index. New logs that are written are being indexed/parsed/identified correctly. Did I miss a step? shouldn't all of the fields that were moved from the "main" index be indexed in the "windows" index? They were properly index/parsed/identified before I moved from main. All of my dashboards and reports that were correct previously, are blank or incorrect now - because the field value pairs aren't being properly identified. Thanks for any help can provide! ... View more