https://community.splunk.com/t5/Getting-Data-In/What-s-Wrong-on-my-inputs-conf/m-p/307847#M57981 <P>Hi lgastaldello,<BR /> as you can see at <A href="https://docs.splunk.com/Documentation/Splunk/6.6.2/Admin/Inputsconf">https://docs.splunk.com/Documentation/Splunk/6.6.2/Admin/Inputsconf</A> in whitelist you have to put a regular expression to search, are you sure that in your events there is exactly what you inserted in whitelist <CODE>Account_Name="xxxxx" EventCode="xxxxx"</CODE><BR /> Exactly means that every word is after the previous and between each of them there is only the number of spaces you used.</P> <P>Anyway, you have to use a regular expression, so charecters as <CODE>=</CODE> or <CODE>"</CODE> must be escaped <CODE>\\</CODE>.</P> <P>Probably you have to use something like this</P> <PRE><CODE>whitelist = Account_Name\=\"xxxxx\".*EventCode\=\"xxxxx\" </CODE></PRE> <P>Bye.<BR /> Giuseppe</P> Sat, 15 Jul 2017 15:01:41 GMT gcusello 2017-07-15T15:01:41Z https://community.splunk.com/t5/Getting-Data-In/What-s-Wrong-on-my-inputs-conf/m-p/307846#M57980 <P>Hi,</P> <P>I am wanting to release locked event to other users just for a user.</P> <P>My inputs.conf:</P> <P>[default]<BR /> host = xxxxx</P> <P>[WinEventLog://Security]<BR /> disabled = 0<BR /> current_only = 1<BR /> checkpointInterval = 5<BR /> whitelist1 = Account_Name="xxxxx" EventCode="xxxxx"<BR /> blacklist2 = 4771, 4776, 4624, 4634, 4769, 4768, 4625, 4672, 4662<BR /> index = xxxx_index</P> <P>Regards</P> Tue, 29 Sep 2020 14:52:49 GMT https://community.splunk.com/t5/Getting-Data-In/What-s-Wrong-on-my-inputs-conf/m-p/307846#M57980 lgastaldello 2020-09-29T14:52:49Z https://community.splunk.com/t5/Getting-Data-In/What-s-Wrong-on-my-inputs-conf/m-p/307847#M57981 <P>Hi lgastaldello,<BR /> as you can see at <A href="https://docs.splunk.com/Documentation/Splunk/6.6.2/Admin/Inputsconf">https://docs.splunk.com/Documentation/Splunk/6.6.2/Admin/Inputsconf</A> in whitelist you have to put a regular expression to search, are you sure that in your events there is exactly what you inserted in whitelist <CODE>Account_Name="xxxxx" EventCode="xxxxx"</CODE><BR /> Exactly means that every word is after the previous and between each of them there is only the number of spaces you used.</P> <P>Anyway, you have to use a regular expression, so charecters as <CODE>=</CODE> or <CODE>"</CODE> must be escaped <CODE>\\</CODE>.</P> <P>Probably you have to use something like this</P> <PRE><CODE>whitelist = Account_Name\=\"xxxxx\".*EventCode\=\"xxxxx\" </CODE></PRE> <P>Bye.<BR /> Giuseppe</P> Sat, 15 Jul 2017 15:01:41 GMT https://community.splunk.com/t5/Getting-Data-In/What-s-Wrong-on-my-inputs-conf/m-p/307847#M57981 gcusello 2017-07-15T15:01:41Z