Splunk Search

Trying to send WindowsEventlogs to different index

mileven
Explorer

Currently trying to limit logs out of the application, security, and system logs. I want to send only application and system critical/error to one index and security to a different index.

[WinEventLog://Application]
checkpointInterval = 5
current_only = 0
disabled = 0
start_from = oldest
index=machine
[WinEventLog://System]
checkpointInterval = 5
current_only = 0
disabled = 0
start_from = oldest
index=machine

Props.conf
[WinEventLog:Application]
TRANSFORMS-FilterEvents = Win_App_Log_FilterErrorEvents

[WinEventLog:System]
TRANSFORMS-FilterEvents = Win_Sys_Log_FilterErrorEvent

transform.conf

[Win_App_Log_FilterErrorEvents]
REGEX = (?ism)Type=Error|Critical
DEST_KEY = queue
FORMAT = nullQueue

[Win_Sys_Log_FilterErrorEvent]
REGEX = (?ism)Type=Error|Critical
DEST_KEY = queue
FORMAT = nullQueue

This is for the security event log

[WinEventLog:Security]
disabled = 0
start_from = oldest
current_only = 0
evt_resolve_ad_obj = 0
checkpointInterval = 5
whitelist = 4674,4720,4725,4726,4727,4728,4740,4947,5136,5137,5141
index = labser_av_ads

I cant' see anything wrong with this.

Tags (2)
0 Karma

yannK
Splunk Employee
Splunk Employee
0 Karma

Lowell
Super Champion

So what behavior are you seeing? BTW, why do you have [WinEventLog://Application] instead of just [WinEventLog:Application]? What's the "\\" for?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...