topic Can I blacklist a SourceName on a Windows Security Log event using a Universal Forwarder? in Getting Data In

Can I blacklist a SourceName on a Windows Security Log event using a Universal Forwarder?

Magnus_001 — Tue, 29 Sep 2020 07:22:07 GMT

Hello,

I am using Splunk Enterprise 6.2.3 Universal Forwarder to monitor events from the Security log on a Windows server. I need to be able to blacklist all events with SourceName = "Microsoft Windows security auditing." and SourceName="Microsoft-Windows-Eventlog". Can this be done? I can blacklist EventCode with a UF but the SourceName doesn't seem to work. Thanks!

This works...

[WinEventLog://Security]
disabled = 0
start_from = oldest
current_only = 0
evt_resolve_ad_obj = 1
checkpointInterval = 5
blacklist1 = EventCode="4747"
blacklist2 = EventCode="4858"

This does not...

[WinEventLog://Security]
disabled = 0
start_from = oldest
current_only = 0
evt_resolve_ad_obj = 1
checkpointInterval = 5
blacklist1 = SourceName="Microsoft-Windows-Eventlog"
blacklist2 = SourceName="Microsoft Windows security auditing."

Re: Can I blacklist a SourceName on a Windows Security Log event using a Universal Forwarder?

Magnus_001 — Tue, 29 Sep 2020 07:23:14 GMT

Hi All,

I got it to work by adding a regex statement to the blacklist.

[WinEventLog://Security]
disabled = 0
start_from = oldest
current_only = 0
evt_resolve_ad_obj = 1
checkpointInterval = 5
blacklist = SourceName="^Microsoft.*$"

Re: Can I blacklist a SourceName on a Windows Security Log event using a Universal Forwarder?

Richfez — Thu, 24 Sep 2015 23:49:20 GMT

I wonder, does it see the "." in your blacklist2 item and believes that's a regex?

It may be worth trying one of the following:

blacklist1 = SourceName="Microsoft-Windows-Eventlog"
blacklist2 = SourceName="Microsoft Windows security auditing\."

blacklist1 = SourceName="Microsoft-Windows-Eventlog"
blacklist2 = SourceName="Microsoft Windows security auditing"

I really don't know precisely HOW it determines if your lines fits the non-regex or the regex filtering way. (As per docs)