Getting Data In

How to edit my props and transforms.conf on an indexer to filter out certain Windows event logs from being indexed?

heathfbsw
Engager

I am trying to filter out certain Windows Events before they are indexed. I need to do this at the indexer if at all possible. I have tried to follow guidelines posted at http://blogs.splunk.com/2012/09/21/the-splunk-app-for-active-directory-and-how-i-tamed-the-security-...
and I have attempted many things found here in Answers. It seems that no matter what I do, I still see the messages that I am trying to filter. I am currently testing with Event Code 4656.

Here is my current setup:
Windows host with Universal Forwarder -> Intermediate Forwarder (ubuntu with Splunk for Windows app) -> Indexer (ubuntu with Splunk for Windows app)

On the indexer I have created two files.
/opt/splunk/etc/apps/Splunk_TA_windows/local/props.conf and /opt/splunk/etc/apps/Splunk_TA_windows/local/transforms.conf
Here are their contents:
/opt/splunk/etc/apps/Splunk_TA_windows/local/props.conf:

[WinEventLog:Security]
TRANSFORMS-set = setnull

/opt/splunk/etc/apps/Splunk_TA_windows/local/transforms.conf:

[setnull]
REGEX = (?msi)EventCode=(5145|4656)
DEST_KEY = queue
FORMAT = nullQueue

Please point out my glaring mistakes. Thanks for any help you provide.

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

These configuration should be available in first full Splunk instance from the source. Since you're using Universal Frowarder, if your Intermediate Forwarder is full Splunk instance, then those configuration should be deployed there.

YOu should be able to filter events based on Event Codes directly on the Universal Forwarder inputs.conf. See this

https://answers.splunk.com/answers/152131/filter-windows-eventcode-using-blacklist-and-whitelist.htm...
http://blogs.splunk.com/2013/10/14/windows-event-logs-in-splunk-6/

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

These configuration should be available in first full Splunk instance from the source. Since you're using Universal Frowarder, if your Intermediate Forwarder is full Splunk instance, then those configuration should be deployed there.

YOu should be able to filter events based on Event Codes directly on the Universal Forwarder inputs.conf. See this

https://answers.splunk.com/answers/152131/filter-windows-eventcode-using-blacklist-and-whitelist.htm...
http://blogs.splunk.com/2013/10/14/windows-event-logs-in-splunk-6/

heathfbsw
Engager

I figured out how to do what I wanted. I have the Universal Forwarder cloning data between two Receivers. One forwards all data on to syslog. The other filters the data and indexes.

Thanks for your response. Telling me that the config should be on the first full Splunk instance helped get me down the correct path.

0 Karma

heathfbsw
Engager

Thanks for the response.

I have been able to change the inputs.conf and blacklist the specific Event Codes in the past and it works very well, but the requirements around these Events have now changed. I am now required to store the Events long term. The solution that I am trying to push forward with is to have the Intermediate Forwarder to send to both a syslog server and the Splunk instance. This is working with the caveat that now Splunk gets the Events that I don't want as well. This is why I chose to deploy the filter at the Indexer.

Should I be able to filter these messages at the Indexer, or will it only work on the first full Splunk instance?

Thanks.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...