topic Re: How to blacklist application event level "Information" on Windows 2012 servers? in Getting Data In

How to blacklist application event level "Information" on Windows 2012 servers?

sim_tcr — Wed, 11 May 2016 12:35:06 GMT

Hello,

How to blacklist application event Level "Information" on Windows 2012 servers.

Already tried:

[WinEventLog:Application]
blacklist = EventType=Information
sourcetype = applicationerrors
disabled = 0
index = osgpp
disabled = false
crcSalt=

[WinEventLog:Application]
blacklist = EventType=0
sourcetype = applicationerrors
disabled = 0
index = osgpp
disabled = false
crcSalt=

Re: How to blacklist application event level "Information" on Windows 2012 servers?

woodcock — Wed, 11 May 2016 14:37:33 GMT

This needs to be deployed to all your forwarders and the Splunk forwarder instance on those servers must be restarted. Even so, only events that are forwarded AFTER the restart will be effected; "wrong" events forwarded before will still be there. You can use the delete command to hide them.

Re: How to blacklist application event level "Information" on Windows 2012 servers?

sim_tcr — Thu, 12 May 2016 15:03:53 GMT

But which one of them is correct?
I tried both.
Forwarders must have restarted whenever i deployed these. I pushed these through deployment server.

Re: How to blacklist application event level "Information" on Windows 2012 servers?

spayneort — Fri, 13 May 2016 14:14:44 GMT

Try changing it to:

[WinEventLog://Application]

instead of:

[WinEventLog:Application]

Re: How to blacklist application event level "Information" on Windows 2012 servers?

sim_tcr — Wed, 18 May 2016 07:43:42 GMT

Tried below and made sure that forwarder was restarted after both changes. Still not working. Still getting Information events.

[WinEventLog://Application]
blacklist = EventType=0
sourcetype = applicationerrors
disabled = 0
index = osgpp
disabled = false
crcSalt=<SOURCE>

and

[WinEventLog://Application]
blacklist = EventType=Information
sourcetype = applicationerrors
disabled = 0
index = osgpp
disabled = false
crcSalt=<SOURCE>

Re: How to blacklist application event level "Information" on Windows 2012 servers?

spayneort — Wed, 18 May 2016 17:04:29 GMT

The EventType filter is for 2003 and earlier. Use Type for 2008 and later. The Microsoft documentation says that the numeric value for Type "Information" is 4.

http://docs.splunk.com/Documentation/Splunk/6.4.1/Data/MonitorWindowseventlogdata

Win32_NTLogEvent class

Re: How to blacklist application event level "Information" on Windows 2012 servers?

sim_tcr — Fri, 20 May 2016 08:27:02 GMT

Tried below and made sure that forwarder was restarted after both changes. Still not working. Still getting Information events.
our server are windows 2012

[WinEventLog://Application]
blacklist = Type=0
sourcetype = applicationerrors
disabled = 0
index = osgpp
disabled = false
crcSalt=<SOURCE>

and

[WinEventLog://Application]
blacklist = Type=Information
sourcetype = applicationerrors
disabled = 0
index = osgpp
disabled = false
crcSalt=<SOURCE>

Re: How to blacklist application event level "Information" on Windows 2012 servers?

yonick — Fri, 20 May 2016 12:08:21 GMT

Have you had a look at this question?

https://answers.splunk.com/answers/152131/filter-windows-eventcode-using-blacklist-and-whitelist.html

Re: How to blacklist application event level "Information" on Windows 2012 servers?

sim_tcr — Wed, 01 Jun 2016 07:31:26 GMT

[WinEventLog://Application]
blacklist = Type="(Information)"
sourcetype = applicationerrors
disabled = 0
index = osgpp
disabled = false
crcSalt=<SOURCE>

Above fixed my issue