topic How do I index only critical events? in Getting Data In

How do I index only critical events?

tmontney — Mon, 28 Jan 2019 20:20:58 GMT

I'm trying to use advanced whitefilter, but I'm coming up short. Basically, I want to index all Windows event logs that have a Type of Critical. I see EventType and Type, but both aren't what I'm looking for.

Perhaps I can do transforms?

Re: How do I index only critical events?

ccl0utier — Mon, 28 Jan 2019 20:49:36 GMT

Assuming you are using Universal Forwarders on your Windows servers, you could use the blacklist facility in inputs.conf.

For example the Splunk Add-on for Microsoft Windows comes with this blacklist by default for security log events:

[WinEventLog://Security]
disabled = 1
start_from = oldest
current_only = 0
evt_resolve_ad_obj = 1
checkpointInterval = 5
blacklist1 = EventCode="4662" Message="Object Type:(?!\s*groupPolicyContainer)"
blacklist2 = EventCode="566" Message="Object Type:(?!\s*groupPolicyContainer)"
renderXml=false

The reference documentation is here: https://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf#Event_Log_whitelist_and_blacklist_formats

Re: How do I index only critical events?

tmontney — Mon, 28 Jan 2019 21:31:33 GMT

Well, I see the field "Level" in the XML of most event logs. Splunk isn't pulling that field by default. If I could get this field working, I could do it this way but not sure how the rendering of XML comes into play.

Re: How do I index only critical events?

ccl0utier — Mon, 28 Jan 2019 21:33:11 GMT

What's your current setup to pull Windows Log Events into Splunk at the moment?
What do the events look like?

Re: How do I index only critical events?

tmontney — Mon, 28 Jan 2019 21:46:26 GMT

Using the standard universal forwarder.

[WinEventLog://Application]
disabled = 0
index = wineventlog
interval = 60
whitelist = 1000, 1001, 11707, 11724

Say for example I wanted to turn this into pulling only Critical level events. The Level field is numeric, always seems to be 1. I know it exists because I can see it in XML View in Event Log viewer, on a PC.

Re: How do I index only critical events?

ccl0utier — Mon, 28 Jan 2019 22:00:46 GMT

I assume you could use the severity_id or severity field?

If not, can you provide an example of your event data and how you'd like to filter them?

Re: How do I index only critical events?

tmontney — Mon, 28 Jan 2019 22:28:19 GMT

If severity ID maps to Level, sure. I'm not seeing that referenced in the docs. Just take your event log and filter for Critical. That's all I'm looking for.

Re: How do I index only critical events?

ccl0utier — Mon, 28 Jan 2019 22:49:47 GMT

I don't have any in my test env.

Re: How do I index only critical events?

tmontney — Mon, 28 Jan 2019 22:57:41 GMT

You can use any of them, like Error or Warning.

Re: How do I index only critical events?

ccl0utier — Wed, 30 Jan 2019 13:59:56 GMT

Not exactly what you are looking for, I know, but you could try to blacklist unwanted events instead and see if that works for you:

blacklist = Type="(Information)"

Alternatively, you could run a network trace to see if the level field is collected by the Splunk UF and in what form and then whitelist only that. I'll try to set that up in my lab and see what I get.