Question : I would like to ingest windows event data using Splunk Heavy Forwarder and need to filter Windows event logs to Splunk indexer. Basically I want to index Winevent (Application , System and Setup) on indexer 136 , All the other winevent Security log to indexer 133 and only winevent Security for EventCode 4634 and 4672 to Indexer144
What are the options to meet this need?
My test is based on Splunk Version 6.3.3.
Here are the setting that worked for me.
1)On Heavy Forwarder – set inputs.conf as
[WinEventLog://Application]
checkpointInterval = 5
current_only = 0
disabled = 0
start_from = oldest
[WinEventLog://Security]
checkpointInterval = 5
current_only = 0
_TCP_ROUTING = LI_133
disabled = 0
start_from = oldest
[WinEventLog://Setup]
checkpointInterval = 5
current_only = 0
disabled = 0
start_from = oldest
[WinEventLog://System]
checkpointInterval = 5
current_only = 0
disabled = 0
start_from = oldest
2) Also Heavy Forwarder has props.conf and transforms.conf as
----Props.conf---------
[WinEventLog:Security]
TRANSFORMS-null= InCludeEvents
----transforms.conf-------
[InCludeEvents]
REGEX = EventCode=(4634|4672)
DEST_KEY = _TCP_ROUTING
FORMAT = LI_144
3) Also Heavy Forwarder-outputs.conf has
[tcpout]
indexAndForward = 1
autoLB = true
compressed = false
defaultGroup = LI_136
[tcpout:LI_136]
server = server_136:9997
[tcpout: LI_144]
server = server_136:9997
[tcpout:LI_133]
server = server_133:9997