topic Re: How to filter Windows Security events by changing inputs conf in Getting Data In

How to filter Windows Security events by changing inputs conf

splunkn — Fri, 10 Apr 2015 12:35:24 GMT

I have made the following changes in my inputs.conf. However no luck
Could anyone help me with this?

[WinEventLog:Security]
ignoreOlderThan=24h
recursive=false
disabled=false
whitelist=1100-1102,1104,1105,1108,4608-4612,4614-4616,4618,4621,4622,4624-4626,4634,4646-4668,4670-4673,4675,4688-4702,4704-4707,4709-4720,4722-4735,4737-4794,4797,4800-4803,4816-4824,4864-4900,4902,4904-4913,4928-4937,4944-4954,4956-4958,4960-4965,4976-4985,5024,5025,5027-5035,5037-5051,5056-5071,5120-5127,5136-5159,5168,5376-5378,5440-5444,5446-5453,5456-5468,5471-5474,5477-5480,5483-5485,5632,5633,5712,5888-5890,6144,6145,6272-6281,6400-6409
index=indexname
sourcetype=sourcetypename

However the above whitelist filter did not work at all. Specifically I dont want Eventcode 4674 events. So I have omitted it in whitelist.But events with 4674 are not getting filtered.

Possible tries:

Do I need to specify blacklist?
Do I mention like this "Eventcode=4566" ?
Do I use anyother stanza to achieve this?

Thanks in advance.

Re: How to filter Windows Security events by changing inputs conf

kendrickt — Fri, 10 Apr 2015 13:21:41 GMT

Hello there,

Have you tried using blacklist instead of whitelist?

There's a good blog you can read here: http://blogs.splunk.com/2013/10/14/windows-event-logs-in-splunk-6/

Re: How to filter Windows Security events by changing inputs conf

splunkn — Mon, 28 Sep 2020 19:33:08 GMT

Many thanks for the reply.

Yes. I have tried both whitelist and blacklist.
Still the filter did not work.
I have also tried to include evt_resolve_ad_obj = 1 in my inputs.conf.
However that also doesn't seem to work.
Could anyone please suggest any other possibilities to filter events based on event codes?

Re: How to filter Windows Security events by changing inputs conf

mendesjo — Sat, 13 Feb 2016 01:39:34 GMT

Same problem.. whitelisting doesn't work. I would think that if you whitelist certain events everything else is blocked but not working for me either.

Re: How to filter Windows Security events by changing inputs conf

laurie_gellatly — Wed, 24 Feb 2016 22:46:23 GMT

As you've not mentioned it, did you check that the UF installed on that machine is actually version 6?

Re: How to filter Windows Security events by changing inputs conf

mendesjo — Wed, 24 Feb 2016 23:10:03 GMT

Found my problem.. between events I had one entry with two commas in a row, which made it not work.. all good.