https://community.splunk.com/t5/Deployment-Architecture/Whitelist-for-WinEventLog-does-not-filter-with-two-fields/m-p/338162#M19045 <P>Hallo,</P> <P>i need help for this stanza. I want only Events for "EventCode=4624 and Logon_Type=10" .<BR /> Whitelist2 works fine.</P> <P>[WinEventLog://Security]<BR /> disabled = false<BR /> start_from = oldest<BR /> evt_resolve_ad_obj = 0<BR /> checkpointInterval = 5<BR /> whitelist1 = EventCode=%^(4624)$% Logon_Type=%^10$%<BR /> whitelist2 = EventCode=%^(4625|4647|4720|4722|4724|4725|4726|4738|4781)$%<BR /> index = infrastrukturlog_windows</P> <P>Thank you</P> <P>Gerd</P> Tue, 29 Sep 2020 15:06:36 GMT gerdhuber 2020-09-29T15:06:36Z https://community.splunk.com/t5/Deployment-Architecture/Whitelist-for-WinEventLog-does-not-filter-with-two-fields/m-p/338162#M19045 <P>Hallo,</P> <P>i need help for this stanza. I want only Events for "EventCode=4624 and Logon_Type=10" .<BR /> Whitelist2 works fine.</P> <P>[WinEventLog://Security]<BR /> disabled = false<BR /> start_from = oldest<BR /> evt_resolve_ad_obj = 0<BR /> checkpointInterval = 5<BR /> whitelist1 = EventCode=%^(4624)$% Logon_Type=%^10$%<BR /> whitelist2 = EventCode=%^(4625|4647|4720|4722|4724|4725|4726|4738|4781)$%<BR /> index = infrastrukturlog_windows</P> <P>Thank you</P> <P>Gerd</P> Tue, 29 Sep 2020 15:06:36 GMT https://community.splunk.com/t5/Deployment-Architecture/Whitelist-for-WinEventLog-does-not-filter-with-two-fields/m-p/338162#M19045 gerdhuber 2020-09-29T15:06:36Z https://community.splunk.com/t5/Deployment-Architecture/Whitelist-for-WinEventLog-does-not-filter-with-two-fields/m-p/338163#M19046 <P>Hi gerdhuber,<BR /> the easiest way is to filter events before indexing on Indexers, see <A href="http://docs.splunk.com/Documentation/Splunk/6.6.2/Forwarding/Routeandfilterdatad">http://docs.splunk.com/Documentation/Splunk/6.6.2/Forwarding/Routeandfilterdatad</A></P> <P>Bye.<BR /> Giuseppe</P> Mon, 31 Jul 2017 07:38:00 GMT https://community.splunk.com/t5/Deployment-Architecture/Whitelist-for-WinEventLog-does-not-filter-with-two-fields/m-p/338163#M19046 gcusello 2017-07-31T07:38:00Z https://community.splunk.com/t5/Deployment-Architecture/Whitelist-for-WinEventLog-does-not-filter-with-two-fields/m-p/338164#M19047 <P>This works for me:</P> <P>whitelist1 = EventCode=%^(4624)$% Message="Logon\sType:\t+10"<BR /> whitelist2 = EventCode=%^(4625|4647|4720|4722|4724|4725|4726|4738|4781)$%</P> Mon, 31 Jul 2017 08:51:44 GMT https://community.splunk.com/t5/Deployment-Architecture/Whitelist-for-WinEventLog-does-not-filter-with-two-fields/m-p/338164#M19047 gerdhuber 2017-07-31T08:51:44Z