topic Re: How to edit my WinEventLog blacklist configuration to exclude AccountNames in Windows Security logs from getting indexed? in Getting Data In

How to edit my WinEventLog blacklist configuration to exclude AccountNames in Windows Security logs from getting indexed?

CaptainHook — Wed, 15 Jun 2016 18:46:26 GMT

I am trying to remove generic service account names from the Windows Security log, so that we can focus on indexing only the specific user accounts. Am I missing something in my inputs.conf?

[WinEventLog://Security] 
disabled = 0 
index = "index"
sourcetype = "sourcetype"
blacklist = Account_Name=name1| name2|name3|name4|name5

Thank you in advance.

Re: How to edit my WinEventLog blacklist configuration to exclude AccountNames in Windows Security logs from getting indexed?

woodcock — Wed, 15 Jun 2016 20:22:42 GMT

Try this instead:

 blacklist1 = Account_Name="name1|name2|name3|name4|name5"

Also, I would not change the sourcetype unless absolutely necessary.

Re: How to edit my WinEventLog blacklist configuration to exclude AccountNames in Windows Security logs from getting indexed?

CaptainHook — Wed, 15 Jun 2016 21:10:21 GMT

Thank you, I will try this shortly. I appreciate that advice on the sourcetype also. I will respond back as soon as I get the chance to test it out. Cheers.

Re: How to edit my WinEventLog blacklist configuration to exclude AccountNames in Windows Security logs from getting indexed?

CaptainHook — Thu, 16 Jun 2016 19:20:08 GMT

Unfortunately, this is still not working. Is there more information I can provide to help come up with a solution?

Re: How to edit my WinEventLog blacklist configuration to exclude AccountNames in Windows Security logs from getting indexed?

woodcock — Thu, 16 Jun 2016 19:22:57 GMT

You need to restart the Splunk instance on the forwarder and then only look at events that have been forwarded in AFTER the restart.

Re: How to edit my WinEventLog blacklist configuration to exclude AccountNames in Windows Security logs from getting indexed?

CaptainHook — Fri, 17 Jun 2016 00:17:08 GMT

I had done a restart on the forwarder itself and did a reload of the deployment server. For some reason it is not omitting all the accounts listed. I have even capture the event name as it shows.

Re: How to edit my WinEventLog blacklist configuration to exclude AccountNames in Windows Security logs from getting indexed?

woodcock — Fri, 17 Jun 2016 03:36:16 GMT

Try removing the double-quotes.

Re: How to edit my WinEventLog blacklist configuration to exclude AccountNames in Windows Security logs from getting indexed?

CaptainHook — Fri, 17 Jun 2016 12:14:18 GMT

Still no luck. Would it make any sense to remove Account_Name and just blacklist the service accounts generically?

Re: How to edit my WinEventLog blacklist configuration to exclude AccountNames in Windows Security logs from getting indexed?

sloshburch — Tue, 29 Sep 2020 10:01:00 GMT

I'm reading the inputs.conf and referenced Windows docs now. A couple thoughts crossed my mind:

Did you try blacklisting a single name? This would be a base case to make sure that if you can get at least one blocked, then the problem is the syntax with blocking multiple. If we can't event get one, then we know the issue is before the multi-value syntax.
The inputs.conf docs imply that Account_Name isn't a valid key to match on in the blacklist. Check the list of valid Keys (the Account_Name part of your syntax) by searching for the table labelled "Create advanced filters with 'whitelist' and 'blacklist'" on http://docs.splunk.com/Documentation/Splunk/6.4.1/Data/MonitorWindowseventlogdata . You might want to explore the 'User' or the 'Message' fields if you agree that Account_Name is not an option. Don't forget regex to match anything before/after the value of the Account_Name - I can support you on that if unclear but I know you'd like to give it a try on your own first.

Re: How to edit my WinEventLog blacklist configuration to exclude AccountNames in Windows Security logs from getting indexed?

CaptainHook — Wed, 22 Jun 2016 12:12:20 GMT

Thanks Burch, I am going to run through this today. I did actually try narrowing it down to one single name initially; the odd thing was that the blacklist seemed to work for a lot of the names using Account_Name. I do agree with you though, that it does not seem to be a valid key to match on. I will try the 'User' and/or 'Message' field. I can always use a little guidance on RegEx 😉 Thanks again.

Re: How to edit my WinEventLog blacklist configuration to exclude AccountNames in Windows Security logs from getting indexed?

CaptainHook — Wed, 22 Jun 2016 15:33:11 GMT

I believe that I may have captured the events with this:

Windows platform specific input processor.

[WinEventLog://Security]
disabled = 0
index = certification
blacklist= Message="Account\sName:\s+(srvHPOM|SYSTEM|(\w+\$))"

Thank you for all the help. As always, the collaboration is greatly appreciated!!!

Re: How to edit my WinEventLog blacklist configuration to exclude AccountNames in Windows Security logs from getting indexed?

sloshburch — Wed, 22 Jun 2016 20:46:02 GMT

Perfect. That's exactly what I was thinking!