Getting Data In

Multiple WMI sources in PROPS.conf

philliphyatt
New Member

Complete newb here, any help appreciated!

props.conf
[WMI:WinEventLog:Security]
TRANSFORMS-set= setnulla,parse2003secevents,parse2008secevents

[WMI:WinEventLog:System]
TRANSFORMS-set= setnullb,parse2003sysevents,parse2008sysevents

Transforms.conf
[setnulla]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue

[parse2003secevents]
REGEX =(?msi)^EventCode=(xxx|xxx)\b
DEST_KEY = queue
FORMAT = indexQueue

[parse2008secevents]
REGEX =(?msi)^EventCode=(xxxx|xxxx)\b
DEST_KEY = queue
FORMAT = indexQueue

[setnullb]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue

[parse2003sysevents]
REGEX =(?msi)^EventCode=(xxx|xxx)\b
DEST_KEY = queue
FORMAT = indexQueue

[parse2008sysevents]
REGEX =(?msi)^EventCode=(xxxx|xxxx)\b
DEST_KEY = queue
FORMAT = indexQueue

Tags (2)
0 Karma

tgow
Splunk Employee
Splunk Employee

As a general rule it is better to configure Splunk to filter out what you don't want and leave the rest to be indexed. The first issue I see is the the "REGEX = ." which means to send all of the data into the null queue. This is a great method to test if the transforms is working but not a good idea. So I am assuming that you want to only filter certain EventCodes from being indexed.

props.conf
[WMI:WinEventLog:Security]
TRANSFORMS-set= setnulla,

transforms.conf
REGEX =(?msi)^EventCode=(4756|4775)
DEST_KEY = queue
FORMAT = nullQueue

This props/transforms combination will not index any EventCode of 4756 or 4775 but all other events will be indexed.

0 Karma

philliphyatt
New Member

Thanks for the response but my intent is to drop everything but the event codes in the [parse] statements. Sorry I guess I should have clarified.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...