topic Re: How do I edit my wineventlog configuration to blacklist a specific SourceName? in Getting Data In

How do I edit my wineventlog configuration to blacklist a specific SourceName?

rmsit — Tue, 12 Jan 2016 18:44:51 GMT

Hello, everyone.

I am having trouble finding a solution to blacklisting a SourceName called "SCLIntra Mobile Sync Service" on my forwarders. Anyone?

inputs.conf

[WinEventLog://Application]
checkpointInterval = 5
current_only = 0
disabled = 0
start_from = oldest
blacklist = SourceName="SCLIntra Mobile Sync Service"

Thanks,
James

Re: How do I edit my wineventlog configuration to blacklist a specific SourceName?

alemarzu — Tue, 12 Jan 2016 19:11:06 GMT

Rmsit,

Try this;

blacklist = SourceName=\"SCLIntra\sMobile\sSync\sService\"

Re: How do I edit my wineventlog configuration to blacklist a specific SourceName?

rmsit — Tue, 12 Jan 2016 23:10:09 GMT

This works! Thanks!

Re: How do I edit my wineventlog configuration to blacklist a specific SourceName?

alemarzu — Wed, 13 Jan 2016 13:03:01 GMT

I'm glad it worked out. Remember its key=regex when you black/whitelist.

Re: How do I edit my wineventlog configuration to blacklist a specific SourceName?

rmsit — Wed, 13 Jan 2016 19:28:45 GMT

Spoke too soon...still not working.

Re: How do I edit my wineventlog configuration to blacklist a specific SourceName?

alemarzu — Wed, 13 Jan 2016 21:00:17 GMT

This is working on my events with Splunk 6.3.x, was't working till I've found a "." at the end of the string.

blacklist = SourceName="SCLIntra Mobile Sync Service\."

Re: How do I edit my wineventlog configuration to blacklist a specific SourceName?

rmsit — Wed, 13 Jan 2016 21:15:04 GMT

Thank you. I will try it.

Re: How do I edit my wineventlog configuration to blacklist a specific SourceName?

rmsit — Thu, 14 Jan 2016 13:40:28 GMT

I am still seeing this SoureName from my forwarder. Is it possible the UF cannot filter it? The UF is version 6.3.1.

Re: How do I edit my wineventlog configuration to blacklist a specific SourceName?

alemarzu — Thu, 14 Jan 2016 14:57:20 GMT

Universal Forwarders can filter wineventlogs since Splunk 6+.

Can you paste an event sample ? Are u black/whitelisting any other thing ?

Re: How do I edit my wineventlog configuration to blacklist a specific SourceName?

rmsit — Thu, 14 Jan 2016 15:27:22 GMT

It is normal Windows event log data. Nothing else is blacklisted/whitelisted for the Application log.

1/14/16
9:56:32.000 AM

01/14/2016 09:56:32 AM
LogName=Application
SourceName=SCLIntra Mobile Sync Service
EventCode=100
EventType=2
Severity = Error

SourceName = SCLIntra Mobile Sync Service

host = v1651ancay014

index = wineventlog

linecount = 55

source = WinEventLog:Application

sourcetype = WinEventLog:Application

Re: How do I edit my wineventlog configuration to blacklist a specific SourceName?

alemarzu — Thu, 14 Jan 2016 17:47:48 GMT

Its weird, try this, tested on Application logs this time.

blacklist = SourceName=%^SLCIntra\sMobile\ssSync\ssService$%

EDIT: Had a typo on SLCIntra.