Splunk Search

I think I have a problem with my Splunk Indexer filter. What is the best way to troubleshoot?

jringley
Engager

Hi! I am trying to setup filtering on my Splunk server that is receiving events from the Splunk universal forwarder on a Windows 2008r2 server. The universal forwarder is configured to only forward security events and was doing so correctly.

I created /opt/splunk/etc/system/local/props.conf

[WinEventLog:Security]
TRANSFORMS-set= setnull

And /opt/splunk/etc/system/local/transforms.conf

[setnull]
REGEX = (?msi)^EventCode=(?!(515|463|462|476)\b)
DEST_KEY = queue
FORMAT = nullQueue

I found http://splunk-base.splunk.com/answers/37593/filter-events-on-indexer and based the filter off of that, but now that I have enabled the above configuration no alerts are coming through at all. Splunk hasn't indexed any events for over an hour now. I would think that I should still be receiving EventCode=4663's (for example.)

Can anyone please tell me what I am doing wrong? Thanks!

0 Karma
1 Solution

bmacias84
Champion

I am assuming that props.conf and transforms.conf are set on you indexer no your UF. I don't think that regex is doing what you want it to do. I tested your regex and it matches EventCode=, causing most events to be sent to null. Everything in your conf files seems to be on the up and up. Below are some variant that work


(?msi)^EventCode=(515|463|462|476|4663)\b
(?msi)^EventCode=(515|463|462|476|4663)
EventCode=(515|463|462|476|4663)

You may want to read Regex Advance.

Hope this helps you or gets you started. Don't forget to vote and accept answer if they help.

View solution in original post

bmacias84
Champion

I am assuming that props.conf and transforms.conf are set on you indexer no your UF. I don't think that regex is doing what you want it to do. I tested your regex and it matches EventCode=, causing most events to be sent to null. Everything in your conf files seems to be on the up and up. Below are some variant that work


(?msi)^EventCode=(515|463|462|476|4663)\b
(?msi)^EventCode=(515|463|462|476|4663)
EventCode=(515|463|462|476|4663)

You may want to read Regex Advance.

Hope this helps you or gets you started. Don't forget to vote and accept answer if they help.

jringley
Engager

Hey bmacias84!

Thank you for the assistance! I ended up using and adding to the second regex that you listed and so far so good! I will definitely check out the Regex Advance link you provided.

edit: Yes, the .conf files are on my indexer

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...