All Apps and Add-ons

Windows Event Log Filtering

servercentraljo
New Member

I've found a number of answers on this but my brain just isn't braining how to do it. I'm looking to filter all of the security events that have a machine account name from my Windows servers to save on quota, as I'm not looking for events of computer accounts logging in an out. It looks like they represent a few gigs a day of our data which is huge.

What I've found so far says I need to edit props.conf and transform.conf to include the regex but I don't know which local folder to put these files in to deploy to my forwarders or my indexer. Following what was included in here, I've put the files into the local folder of the Splunk_TA_windows app: http://answers.splunk.com/answers/124942/filtering-windows-security-event-logs-with-regex

Is that where this filter belongs? How can I change the regex to kill off anything with a $ in the Account_Name field, not just event ID 4624? Thanks!

0 Karma

servercentraljo
New Member

So I edited the input.conf on the Splunk_TA_windows/local directory but from what I'm reading we need to use the heavy forwarder to blacklist based on a regex. I'm using the universal forwarder. Is that correct?

0 Karma

rsennett_splunk
Splunk Employee
Splunk Employee

The "old School method" in the answers thread you've noted works just fine...
But since you're mentioning the Windows Infrastructure App... it's probable that you're on 6.x+

In 6.x more Windows Event Specific stuff was added to inputs.conf directives...

You might want to check out the current inputs.conf documentation:
HERE specifically, once you've got the doc open search within the document for "# Windows Event Log Monitor" and then scroll down to the section on Whitelist/Blacklist.

as for the question of "on the forwarder" or "on the indexer' that depends on whether you want to send the events at all or only send what you know you want to index, and how you go about enacting your filtering. In this case... probably inputs.conf on the forwarder if you're going to use whitelist/blacklist

With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!
0 Karma

servercentraljo
New Member

So I edited the input.conf on the Splunk_TA_windows/local directory but from what I'm reading we need to use the heavy forwarder to blacklist based on a regex. I'm using the universal forwarder. Is that correct?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...