Getting Data In

How to filter out or send to a null queue windows event logs with universal forwarder 6.x?

liquid
Engager

i'm using UF6 and I want to filter out or send to a null queue uninteresting Windows events with UF6.

0 Karma

neelamssantosh
Contributor

we can filetr the unwanted traffic to be dropped by moving them to nullQueue.

props.conf:
[source::....log...]
TRANSFORMS-debug_log = debug_log_transform

in transforms.conf:
[debug_log_transform]
REGEX=
DEST_KEY = queue
FORMAT = nullQueue

so the respective matched REGEX data will not be indexed and therefore it will not affect our license limit too.
http://docs.splunk.com/Documentation/Splunk/6.1.3/Forwarding/Routeandfilterdatad

0 Karma

neelamssantosh
Contributor

Besides routing to receivers, forwarders can also filter and route data to specific queues or discard the data altogether by routing to the null queue.
http://docs.splunk.com/Documentation/Splunk/6.1.3/Forwarding/Routeandfilterdatad

0 Karma

lcshared
Explorer

this only works on an indexer not on an UF as stated in the question

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi liquid,

take a look at the docs Use_the_Security_event_log_to_monitor_changes_to_files this will provide examples on how to blacklist certain windows event log entries by event code.

also good to read: http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings

hope this helps ...

cheers, MuS

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...