Getting Data In

Multiple WMI sources in PROPS.conf

philliphyatt
New Member

Complete newb here, any help appreciated!

props.conf
[WMI:WinEventLog:Security]
TRANSFORMS-set= setnulla,parse2003secevents,parse2008secevents

[WMI:WinEventLog:System]
TRANSFORMS-set= setnullb,parse2003sysevents,parse2008sysevents

Transforms.conf
[setnulla]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue

[parse2003secevents]
REGEX =(?msi)^EventCode=(xxx|xxx)\b
DEST_KEY = queue
FORMAT = indexQueue

[parse2008secevents]
REGEX =(?msi)^EventCode=(xxxx|xxxx)\b
DEST_KEY = queue
FORMAT = indexQueue

[setnullb]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue

[parse2003sysevents]
REGEX =(?msi)^EventCode=(xxx|xxx)\b
DEST_KEY = queue
FORMAT = indexQueue

[parse2008sysevents]
REGEX =(?msi)^EventCode=(xxxx|xxxx)\b
DEST_KEY = queue
FORMAT = indexQueue

Tags (2)
0 Karma

tgow
Splunk Employee
Splunk Employee

As a general rule it is better to configure Splunk to filter out what you don't want and leave the rest to be indexed. The first issue I see is the the "REGEX = ." which means to send all of the data into the null queue. This is a great method to test if the transforms is working but not a good idea. So I am assuming that you want to only filter certain EventCodes from being indexed.

props.conf
[WMI:WinEventLog:Security]
TRANSFORMS-set= setnulla,

transforms.conf
REGEX =(?msi)^EventCode=(4756|4775)
DEST_KEY = queue
FORMAT = nullQueue

This props/transforms combination will not index any EventCode of 4756 or 4775 but all other events will be indexed.

0 Karma

philliphyatt
New Member

Thanks for the response but my intent is to drop everything but the event codes in the [parse] statements. Sorry I guess I should have clarified.

0 Karma
Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...