topic Specific Wineventlog (Security) ingestion into Splunk in Security

Specific Wineventlog (Security) ingestion into Splunk

anandhalagarasa — Mon, 21 Oct 2019 08:07:56 GMT

Hi Team,

Currently we are ingesting all data from wineventlog Security, Application & System from all Windows Client machines. And due to this ingestion we are overloaded with the license usage and now we are planning only to ingest only the critical EventCode (4688,4624) and so on and the remaining Security wineventlog are not required so kindly let me know how to pull the data for a particular EventCode from all windows machine so that we will implement the same and check it.

Current Inputs:

[WinEventLog://Application]
disabled = 0
index = xxx
renderXml=0

[WinEventLog://Security]
disabled = 0
index = xxx
renderXml=0

[WinEventLog://System]
disabled = 0
index = xxx
renderXml=0

So it would be really helpful if i can ingest only the particular eventcode from wineventlog:security so that we will be saving some licenses.

Re: Specific Wineventlog (Security) ingestion into Splunk

dauren_akilbeko — Mon, 21 Oct 2019 08:33:19 GMT

Use whitelist/blacklist functionality in inputs.
Docs - https://docs.splunk.com/Documentation/Splunk/7.3.2/Data/Whitelistorblacklistspecificincomingdata
Similar question - https://answers.splunk.com/answers/152131/filter-windows-eventcode-using-blacklist-and-whitelist.html

You can also clean up events - https://docs.splunk.com/Documentation/WindowsAddOn/6.0.0/User/Configuration#Configure_event_cleanup_best_practices_in_props.conf

Re: Specific Wineventlog (Security) ingestion into Splunk

tbavarva — Mon, 21 Oct 2019 08:37:55 GMT

Hi,

I hope below link will give you an idea.

https://answers.splunk.com/answers/152131/filter-windows-eventcode-using-blacklist-and-whitelist.html

Regards,
Tejas