I've seen various answers to this general area of questioning, but I'm wondering what the current best practice is.
I've just setup a brand new Splunk server on a Linux machine, and I'm starting off by pointing Windows 2008 R2 servers to it with the Universal Forwarder. The catch here is that I don't want everything from the Windows Event Logs. I'm only interested in Warnings and Errors and ideally I don't want to have to parse them out on the server... I'd much prefer that they don't get transmitted at all. Thoughts?
universal and light forwarders do not parse events, which is part of why they have a smaller resource footprint. if you want to filter specific events out before they hit your indexer, you must use a heavy forwarder (so that it can check the events individually). information about doing this is here:
http://www.splunk.com/base/Documentation/latest/Deploy/Routeandfilterdatad
universal and light forwarders do not parse events, which is part of why they have a smaller resource footprint. if you want to filter specific events out before they hit your indexer, you must use a heavy forwarder (so that it can check the events individually). information about doing this is here:
http://www.splunk.com/base/Documentation/latest/Deploy/Routeandfilterdatad
Based upon this, I installed a full instance, added some local logs, disabled splunkweb, and edited these files under /etc/system/local/:
props.conf
[source::WinEventLog:Application]
TRANSFORMS-null= setnull
[source::WinEventLog:DNS Server]
TRANSFORMS-null= setnull
[source::WinEventLog:Directory Service]
TRANSFORMS-null= setnull
[source::WinEventLog:Security]
TRANSFORMS-null= setnull
[source::WinEventLog:System]
TRANSFORMS-null= setnull
transforms.conf
[setnull]
REGEX = (?m)^Type=Information
DEST_KEY = queue
FORMAT = nullQueue
Is this the appropriate way of achieving what I'm looking for?