WinEvent Filtering on Heavy Forwarder

Question

Hi, Trying to send all eventIDs from WinEventLog:Security to NullQueue with the exception of 592 and 593. Still getting all security events indexed :< props.conf and transforms.conf, located in Splunk\etc\system\local on the forwarder are as follows:

props.conf

[WinEventLog:Security]
TRANSFORMS-set=setnull,setparsing

transforms.conf

[setnull]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue

[setparsing]
REGEX = (?m)^EventCode=(592|593)
DEST_KEY = queue
FORMAT = indexQueue

Thanks, Andie

Answer 1

1	Take a look at this answer regarding whitelisting specific event codes to be forwarded. http://answers.splunk.com/questions/9076/how-to-configure-a-forwarder-to-filter-and-send-only-the-events-i-want link answered 16 Nov '10, 23:14 maverick ♦ 2.5k●3●4●55 accept rate: 14%

Answer 2

Hi, a couple things.

1) If you use a LightWeightForwarder, you might have to put those configurations on the indexer too.

2) Windows Security event logs have white spaces before "EventCode", so binding your regex to the start of the line should not work.

REGEX = (?m)EventCode=(592|593)

You could also do the same job with a simpler configuration, though:

props.conf

[WinEventLog:Security]
TRANSFORMS-set=dropevents

transforms.conf

[dropevents]
REGEX = (?m)EventCode=(?!592|593)
DEST_KEY = queue
FORMAT = nullQueue

This regex means "discard everything that has EventCode different from either 592 or 593"

Answer 3

0	Try (?msi) instead of just (?m) link answered 18 Aug '10, 17:51 BunnyHop 715●3●3●22 accept rate: 25%

WinEvent Filtering on Heavy Forwarder

Follow this question

Splunk Resources

Related questions