Knowledge Management

How to limit the import of logs on a windows tray with a specification of inputs to recover ?

jcollin
New Member

Hello,
I am a new user Splunk.
I recovered the logs security events log of Windows (the audit access to objects).
Is it possible to specify what type of event is sent to the recipient by the universal forwarder with keywords.

example:

03/21/2013 10:06:23 AM AM ...
26 lines omitted ..
Information on access request:
Access Mask: 0x10080
Access: DELETE
ReadAttributes

In this example, recover only the events with the access to "DELETE".

Thank you.

Tags (1)
0 Karma

jcollin
New Member

Hello, I actually read the documentation but I have not found a mask element corresponding to the event windows.
these lines could match but it must be placed in the inputs.conf or output.conf the forwarder?

[WinEventLog: Security]
disabled = 0
start_from = newest
evt_dc_name =
evt_dns_name =
evt_resolve_ad_obj = 1
checkpointInterval = 5

Is it possible to add a line that matches a element "access" an entry in the event of Journal?

0 Karma

Ayn
Legend

Yes. You can filter events on the indexer. There are loads of questions on this on splunkbase, so I recommend you look around. Also the docs section regarding filtering events is here: http://docs.splunk.com/Documentation/Splunk/5.0.2/Deploy/Routeandfilterdatad#Discard_specific_events...

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...