topic Re: Windows Event Codes Whitelist not working in Getting Data In

Windows Event Codes Whitelist not working

knutsod — Thu, 26 Jun 2014 20:16:46 GMT

I am using a deployment server to push out a config to several universal forwarders (version 6.1.1) on windows, everything seems to be working fine but the whitelist part.
inputs.conf:
[WinEventLog:Security] disabled = 0 whitelist = 508,510,576
I have also tried the following whitelist configs:
whitelist1 = 508,510,576
whitelist = 508|510|576

Nothing seems to work, I am seeing all the event IDs coming through to my indexer.

Re: Windows Event Codes Whitelist not working

knutsod — Fri, 27 Jun 2014 16:02:05 GMT

Also note that the universal forwarders are version 6.1.1 but the heavy forwarder they are sending data to is splunk version 5.0.4.

Re: Windows Event Codes Whitelist not working

yannK — Fri, 27 Jun 2014 17:46:29 GMT

Just to make sure, can you try with the 6.* input format with double slashs ?

[WinEventLog://Security] disabled = 0 whitelist = 508,510,576
http://docs.splunk.com/Documentation/Splunk/6.1.1/Data/MonitorWindowsdata

Re: Windows Event Codes Whitelist not working

knutsod — Fri, 27 Jun 2014 18:16:12 GMT

When the app gets deployed the // is added. So on the 6.1.1 universal forwarders it looks like that already.

Re: Windows Event Codes Whitelist not working

mendesjo — Sat, 13 Feb 2016 00:49:23 GMT

Same problem.. ever find a solution?