Complete newb here, any help appreciated!
props.conf
[WMI:WinEventLog:Security]
TRANSFORMS-set= setnulla,parse2003secevents,parse2008secevents
[WMI:WinEventLog:System]
TRANSFORMS-set= setnullb,parse2003sysevents,parse2008sysevents
Transforms.conf
[setnulla]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue
[parse2003secevents]
REGEX =(?msi)^EventCode=(xxx|xxx)\b
DEST_KEY = queue
FORMAT = indexQueue
[parse2008secevents]
REGEX =(?msi)^EventCode=(xxxx|xxxx)\b
DEST_KEY = queue
FORMAT = indexQueue
[setnullb]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue
[parse2003sysevents]
REGEX =(?msi)^EventCode=(xxx|xxx)\b
DEST_KEY = queue
FORMAT = indexQueue
[parse2008sysevents]
REGEX =(?msi)^EventCode=(xxxx|xxxx)\b
DEST_KEY = queue
FORMAT = indexQueue
As a general rule it is better to configure Splunk to filter out what you don't want and leave the rest to be indexed. The first issue I see is the the "REGEX = ." which means to send all of the data into the null queue. This is a great method to test if the transforms is working but not a good idea. So I am assuming that you want to only filter certain EventCodes from being indexed.
props.conf
[WMI:WinEventLog:Security]
TRANSFORMS-set= setnulla,
transforms.conf
REGEX =(?msi)^EventCode=(4756|4775)
DEST_KEY = queue
FORMAT = nullQueue
This props/transforms combination will not index any EventCode of 4756 or 4775 but all other events will be indexed.
Thanks for the response but my intent is to drop everything but the event codes in the [parse] statements. Sorry I guess I should have clarified.