topic Re: Please help with how do I get a list of all Windows event codes that are being ingested into Splunk Ent. ? Thx a mil in Splunk Enterprise

Please help with how do I get a list of all Windows event codes that are being ingested into Splunk Ent. ? Thx a million

SamHTexas — Tue, 21 Sep 2021 15:10:06 GMT

How do I get a list of all Windows event codes being ingested into Splunk please?

bray1111 — Tue, 21 Sep 2021 15:31:52 GMT

Are you asking for what you have defined in inputs.conf as far as deny or do you want to find what event codes have been ingested?

This question/answer covers the inputs entries related to denies. https://community.splunk.com/t5/Getting-Data-In/How-to-create-more-than-10-blacklists-for-the-same-input/m-p/289583

this search should give you a breakdown of event codes with counts per code.

index=wineventlog
| stats count by EventCode

You'll probably want to expand on that using other fields like source and Name to better understand the codes.

ashvinpandey — Tue, 21 Sep 2021 15:42:25 GMT

@SamHTexas Use the below query after adding your index and sourcetype:

Run this in the smart mode and timerange for around 7 days or 30 days if possible to get the total list

| search EventCode="*" | stats count by EventCode

Also, If this reply helps you, an upvote would be appreciated.