All Apps and Add-ons

Windows Event Log Filtering

servercentraljo
New Member

I've found a number of answers on this but my brain just isn't braining how to do it. I'm looking to filter all of the security events that have a machine account name from my Windows servers to save on quota, as I'm not looking for events of computer accounts logging in an out. It looks like they represent a few gigs a day of our data which is huge.

What I've found so far says I need to edit props.conf and transform.conf to include the regex but I don't know which local folder to put these files in to deploy to my forwarders or my indexer. Following what was included in here, I've put the files into the local folder of the Splunk_TA_windows app: http://answers.splunk.com/answers/124942/filtering-windows-security-event-logs-with-regex

Is that where this filter belongs? How can I change the regex to kill off anything with a $ in the Account_Name field, not just event ID 4624? Thanks!

0 Karma

servercentraljo
New Member

So I edited the input.conf on the Splunk_TA_windows/local directory but from what I'm reading we need to use the heavy forwarder to blacklist based on a regex. I'm using the universal forwarder. Is that correct?

0 Karma

rsennett_splunk
Splunk Employee
Splunk Employee

The "old School method" in the answers thread you've noted works just fine...
But since you're mentioning the Windows Infrastructure App... it's probable that you're on 6.x+

In 6.x more Windows Event Specific stuff was added to inputs.conf directives...

You might want to check out the current inputs.conf documentation:
HERE specifically, once you've got the doc open search within the document for "# Windows Event Log Monitor" and then scroll down to the section on Whitelist/Blacklist.

as for the question of "on the forwarder" or "on the indexer' that depends on whether you want to send the events at all or only send what you know you want to index, and how you go about enacting your filtering. In this case... probably inputs.conf on the forwarder if you're going to use whitelist/blacklist

With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!
0 Karma

servercentraljo
New Member

So I edited the input.conf on the Splunk_TA_windows/local directory but from what I'm reading we need to use the heavy forwarder to blacklist based on a regex. I'm using the universal forwarder. Is that correct?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...