Getting Data In

Problem to discard some WMI events in FileServer with heavyfwd

mgaleti
New Member

I installed a Splunk (Heavy Forwarder) in my Windows 2007 Std SP1 FILE SERVER.
Installed, too, Windows APPs.

I configured it to forward to my Splunk Index Server and this FILESERVER is forwarding correctly (I can see SECURITY events in search app of my Splunk Server).

I would like to >NOT< send WMI secutiry events with Event ID 4673 and 4658 and, for this I made:

1) Inside C:\Program Files\Splunk\etc\apps\windows\default\props.conf

I inserted
[WMI:WinEventLog:Security]
TRANSFORMS-wmi=wminull

2) Inside C:\Program Files\Splunk\etc\apps\windows\default\transform.conf

[wminull]
REGEX=(?m)^EventCode=(4673|4658)
DEST_KEY=queue
FORMAT=nullQueue

After this I re-started this FileServer service and tried to check splunk server but this events 4673 and 4658 still being collected from this server.

Is this regex wrong ?
Thanks !!!!!!!

Tags (2)
0 Karma

_d_
Splunk Employee
Splunk Employee

The regex seems fine but I would recommend that you do NOT edit anything in the C:\Program Files\Splunk\etc\system\default directory. Instead, try creating a props.conf and a transforms.conf in C:\Program Files\Splunk\etc\system\local and try again. Also, try changing stanza headers as per below to reflect correct sourcetype.

C:\Program Files\Splunk\etc\system\local\props.conf
[WinEventLog:Security]
TRANSFORMS-wmi=wminull

C:\Program Files\Splunk\etc\system\local\transforms.conf
[wminull]
REGEX=(?mi)EventCode=(4673|4658)
DEST_KEY=queue
FORMAT=nullQueue

Notice, that I changed the regex slightly - it should not matter - AND i change the stanza header for the sourcetype in props.conf.

Hope this helps.

> please upvote and accept answer if you find it useful - thanks!

0 Karma

_d_
Splunk Employee
Splunk Employee

mgaleti, please accept answer and upvote so that other community members can find it useful. Thanks.

0 Karma

mgaleti
New Member

Great !!!! Thanks ! Worked fine,

0 Karma
Get Updates on the Splunk Community!

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...