topic Re: not able to whitelist windows events logs in All Apps and Add-ons

not able to whitelist windows events logs

jitendrasingh12 — Mon, 28 Sep 2020 19:56:00 GMT

Dear All ,

          i am using below inputs.conf to white list few windows event logs that i only need for my syslog . Rest i want to drop but some how its not working fine for me ..Request help on this from you..

[WinEventLog://Security]
disabled = 0
start_from = oldest
current_only = 0
evt_resolve_ad_obj = 1
checkpointInterval = 5
whitelist = 624,627,629,630,1100,1102,1104,4616,4618,4698,4720,4723,4724,4725,4726,4733,4734,4735,4739,4740
index = wineventlog
renderXml=false

http://blogs.splunk.com/2013/10/14/windows-event-logs-in-splunk-6/

http://answers.splunk.com/answers/152131/filter-windows-eventcode-using-blacklist-and-whitelist.html

Re: not able to whitelist windows events logs

mendesjo — Sat, 13 Feb 2016 00:58:22 GMT

same problem, every find an answer?

Re: not able to whitelist windows events logs

somesoni2 — Sat, 13 Feb 2016 02:38:03 GMT

Look at Test 3 (traditional filtering) from the highest voted answer from below post.

https://answers.splunk.com/answers/152131/filter-windows-eventcode-using-blacklist-and-whitelist.html

Re: not able to whitelist windows events logs

mendesjo — Sat, 13 Feb 2016 03:06:20 GMT

I found my issue.. I had a long list of event codes and I had two commas together.. UGGG! but that was my issue. Thanks for the reply.

Re: not able to whitelist windows events logs

javiergn — Mon, 15 Feb 2016 09:38:39 GMT

Hi,

Can you run btool and tell us exactly what your Security stanza looks like?

./splunk cmd btool inputs list --debug

http://docs.splunk.com/Documentation/Splunk/latest/Troubleshooting/Usebtooltotroubleshootconfigurations

There might be other apps conflicting with yours.

By the way, when you say "somehow it's not working fine for me", can you be more specific?

Thanks,
J

Re: not able to whitelist windows events logs

mendesjo — Mon, 15 Feb 2016 14:16:48 GMT

My issue was in my whitelist line I had 2 commas together at one point. After I found that it works as expected.