Getting Data In

How can I create a filter to capture certain events from security logs?

ph1llies05
New Member

Hi All,

I'm a newbie to the Splunk world and trying to figure out a couple things. I currently have Splunk Light installed and used the "Remote Event Log Collection" option to collect logs from my system. My question is: Can I create filters to only capture certain events from the security logs? Or do I need to configure the universal forwarder to collect the logs from my systems then configure filters prior to data getting indexed? Thanks, any info you can provide would be great.

0 Karma
1 Solution

lguinn2
Legend

You should let the universal forwarder collect the entire log and then filter on the indexer.

Exception: for Windows event logs, you can blacklist or whitelist event codes on the universal forwarder. To do this, you will need to add filters to the inputs.conf on the universal forwarder, as described in Monitor Windows event log data: Create advanced filters with 'whitelist' and 'blacklist'

View solution in original post

lguinn2
Legend

You should let the universal forwarder collect the entire log and then filter on the indexer.

Exception: for Windows event logs, you can blacklist or whitelist event codes on the universal forwarder. To do this, you will need to add filters to the inputs.conf on the universal forwarder, as described in Monitor Windows event log data: Create advanced filters with 'whitelist' and 'blacklist'

ph1llies05
New Member

Thanks for the response. Last question, does the universal forwarder need to be configured on a separate system from the Splunk Light server?

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Yes, the Universal Forwarder sits on the remote machine which is generating data.. The Forwarder will send this data to the indexer (Where Splunk is installed)

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...