topic Re: PowerShell Logging- Blacklist everything except Event Code 4104 & Level: Warning in Getting Data In

PowerShell Logging- Blacklist everything except Event Code 4104 & Level: Warning

alyssasc — Tue, 26 Jun 2018 16:10:40 GMT

We are attempting to ingest server powershell logging into Splunk. We found that ingest all the data was noisy and want to reduce the data ingested to what we really care about. Our goal is to only ingest Event Code 4104 with the level: Warning.

Is there a way to blacklist everything, and then whitelist only Event Code 4104 with the level: Warning?
We are ingesting via here: [WinEventLog://Microsoft-Windows-PowerShell/Operational]

Re: PowerShell Logging- Blacklist everything except Event Code 4104 & Level: Warning

jdhunter — Thu, 19 Jul 2018 21:56:18 GMT

inputs.conf - http://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf

Look at the Windows Event Log Monitor Section

Example from inputs.conf documentation:
whitelist = EventCode=%^200$% User=%jrodman%
Include events only if they have EventCode 200 and relate to User jrodman

Follow this pattern for your EventCode and Second Field you want to match