Getting Data In

WinEventLog:Security filtering does not work

arapozo
Explorer

Even after reading the documentation and a lot of posts here on answers, I just can't get filtering to work. I've recently installed two VM to test it out.

One indexer server and one universal forwarder. The configuration is being done in the Indexer since universal forwarder according to the docs doesn't do parsing.

REGEX is set to "." to test if the filtering is working.

SPLUNK\etc\system\local\props.conf
[WinEventLog:Security]
TRANSFORMS-setnull = setnull

SPLUNK\etc\system\local\transforms.conf
[setnull]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue

Isn't this configuration supposed to filter everything from WinEventLog:Security?
I get all the logs anyways.

Additional information that may be related:

http://answers.splunk.com/questions/13196/universal-forwarder-sending-cooked-data-to-indexer

1 Solution

Ellen
Splunk Employee
Splunk Employee

You have run into a known issue (SPL-38443) with the 4.2 Lightweight and Universal Forwarder.

The Windows 4.2 lightweight and universal forwarder parses WinEventLog datastreams on the forwarder, preventing all parsing control on the indexer.

The symptoms of this are: no filtering nor routing to the nullqueue based on props and transforms. WinEventLog data is bypassing props.conf and transforms.conf on the indexer.

The workaround would be to use a 4.2 full/regular forwarder or 4.1.x lightweight forwarder but this will be fixed for 4.2.1

http://www.splunk.com/base/Documentation/latest/ReleaseNotes/Knownissues

View solution in original post

Ellen
Splunk Employee
Splunk Employee

You have run into a known issue (SPL-38443) with the 4.2 Lightweight and Universal Forwarder.

The Windows 4.2 lightweight and universal forwarder parses WinEventLog datastreams on the forwarder, preventing all parsing control on the indexer.

The symptoms of this are: no filtering nor routing to the nullqueue based on props and transforms. WinEventLog data is bypassing props.conf and transforms.conf on the indexer.

The workaround would be to use a 4.2 full/regular forwarder or 4.1.x lightweight forwarder but this will be fixed for 4.2.1

http://www.splunk.com/base/Documentation/latest/ReleaseNotes/Knownissues

MuS
SplunkTrust
SplunkTrust

Hi Ellen,
is this really solved in 4.2.1 universal forwarder? I just ran into exactly this problem, that I was unable to redirect WinEventLog events no matter what transform I used. Only way to get them into different indexes was to set the index in inputs.conf on the 4.2.1 universal forwarder.

best regards, MuS

0 Karma

arapozo
Explorer

I just installed the forwarder and only selected the security log in the wizard, nothing else.

0 Karma

jbsplunk
Splunk Employee
Splunk Employee

What does the input on the Universal Forwarder use to get data from the event logs?

0 Karma

arapozo
Explorer

I'm not using WMI to collect events, the source is always a universal forwarder.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...