Getting Data In

Filter Windows Event Data to different Targets?

rbal_splunk
Splunk Employee
Splunk Employee

Question : I would like to ingest windows event data using Splunk Heavy Forwarder and need to filter Windows event logs to Splunk indexer. Basically I want to index Winevent (Application , System and Setup) on indexer 136 , All the other winevent Security log to indexer 133 and only winevent Security for EventCode 4634 and 4672 to Indexer144

What are the options to meet this need?

0 Karma

rbal_splunk
Splunk Employee
Splunk Employee

My test is based on Splunk Version 6.3.3.

Here are the setting that worked for me.

1)On Heavy Forwarder – set inputs.conf as

[WinEventLog://Application]
checkpointInterval = 5
current_only = 0
disabled = 0
start_from = oldest

[WinEventLog://Security]
checkpointInterval = 5
current_only = 0
_TCP_ROUTING = LI_133
disabled = 0
start_from = oldest

[WinEventLog://Setup]
checkpointInterval = 5
current_only = 0
disabled = 0
start_from = oldest

[WinEventLog://System]
checkpointInterval = 5
current_only = 0
disabled = 0
start_from = oldest

2) Also Heavy Forwarder has props.conf and transforms.conf as

----Props.conf---------
[WinEventLog:Security]
TRANSFORMS-null= InCludeEvents

----transforms.conf-------
[InCludeEvents]
REGEX = EventCode=(4634|4672)
DEST_KEY = _TCP_ROUTING
FORMAT = LI_144

3) Also Heavy Forwarder-outputs.conf has

[tcpout]
indexAndForward = 1
autoLB = true
compressed = false
defaultGroup = LI_136

[tcpout:LI_136]
server = server_136:9997

[tcpout: LI_144]
server = server_136:9997

[tcpout:LI_133]
server = server_133:9997

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...