topic Re: Filter Windows EventCode 0 in Getting Data In

Why are all events being filter except for EventCode 0 when filtering Windows Events?

splunkcol — Tue, 01 Mar 2022 16:46:18 GMT

I'm filtering windows events from the Heavy Forwarder, everything works fine, all events are filtered except for EventCode = 0 any idea why?

splunkcol — Thu, 23 Sep 2021 15:05:25 GMT

EventCode 0 was not being filtered because it is an Application event and not a security event.

In this way I solved it

props.conf

[source::WinEventLog:Application]
TRANSFORMS-wmi = setnull2

transforms.conf

[setnull2]
REGEX= (?msi) ^EventCode=(0)
DEST_KEY=queue
FORMAT=nullQueue

jdhunter — Mon, 28 Feb 2022 21:47:59 GMT

We were able to filter it out from the UF using the following in our inputs.conf:

[WinEventLog://Application]
disabled = 0
index = windows_index
blacklist1 = EventCode="0"