topic Re: Blacklist Windows Event ID 4769 in Getting Data In

Blacklist Windows Event ID 4769

Yadukrishnan — Tue, 16 Jan 2024 13:39:00 GMT

Hi,

I am trying to blacklist Windows Event ID 4769 from a particular User ID. Is this possible to be implemented.

I already added the following Blacklist but it didnt seem to work.

blacklist = EventCode="4769" User="Account Name"

Re: Blacklist Windows Event ID 4769

richgalloway — Tue, 16 Jan 2024 14:16:03 GMT

"Seem"? Either it worked or it didn't.

In which file did you add that line? On which Splunk instance? Did you restart Splunk after making the change?

Re: Blacklist Windows Event ID 4769

PickleRick — Tue, 16 Jan 2024 14:56:06 GMT

1. Where are you putting those settings to?

2. What format are you ingesting your eventlogs in?

Re: Blacklist Windows Event ID 4769

Yadukrishnan — Thu, 18 Jan 2024 12:11:20 GMT

I am making changes on opt splunk etc apps splunk_ta_win local inputs.conf. The Windows Event IDs are collected using Universal Forwarder. There is one another blacklist in the same configuration file which is working fine with out any issues.

Re: Blacklist Windows Event ID 4769

Yadukrishnan — Thu, 18 Jan 2024 12:11:52 GMT

Didnt work. Yes, I have restarted the services after making the changes.

Re: Blacklist Windows Event ID 4769

PickleRick — Thu, 18 Jan 2024 12:46:49 GMT

OK.

How are you ingesting your events? key/value or XML?

Does the other (working) blacklist entry specify just the event code?