https://community.splunk.com/t5/Getting-Data-In/Monitor-Windows-Event-Log-for-Critical-Error/m-p/502991#M85677 <P>I want to monitor certain events <STRONG>and</STRONG> all Error/Critical level events.</P> <P><A href="https://answers.splunk.com/answers/663023/how-to-monitor-wineventlogsystem-event-logs-for-cr.html">https://answers.splunk.com/answers/663023/how-to-monitor-wineventlogsystem-event-logs-for-cr.html</A></P> <PRE><CODE>[WinEventLog://Application] disabled = 0 index = wineventlog interval = 60 whitelist = 1000, 1001, 11707, 11724, 104 whitelist2 = Type="^[1|2]" </CODE></PRE> <P>Tried it with and without <CODE>whitelist</CODE> commented out (thinking it was overriding it). It isn't picking up the events.</P> Wed, 25 Mar 2020 15:19:16 GMT tmontney 2020-03-25T15:19:16Z https://community.splunk.com/t5/Getting-Data-In/Monitor-Windows-Event-Log-for-Critical-Error/m-p/502991#M85677 <P>I want to monitor certain events <STRONG>and</STRONG> all Error/Critical level events.</P> <P><A href="https://answers.splunk.com/answers/663023/how-to-monitor-wineventlogsystem-event-logs-for-cr.html">https://answers.splunk.com/answers/663023/how-to-monitor-wineventlogsystem-event-logs-for-cr.html</A></P> <PRE><CODE>[WinEventLog://Application] disabled = 0 index = wineventlog interval = 60 whitelist = 1000, 1001, 11707, 11724, 104 whitelist2 = Type="^[1|2]" </CODE></PRE> <P>Tried it with and without <CODE>whitelist</CODE> commented out (thinking it was overriding it). It isn't picking up the events.</P> Wed, 25 Mar 2020 15:19:16 GMT https://community.splunk.com/t5/Getting-Data-In/Monitor-Windows-Event-Log-for-Critical-Error/m-p/502991#M85677 tmontney 2020-03-25T15:19:16Z https://community.splunk.com/t5/Getting-Data-In/Monitor-Windows-Event-Log-for-Critical-Error/m-p/502992#M85678 <P>This is the correct stanza:</P> <PRE><CODE>[WinEventLog://Application] disabled = 0 index = wineventlog whitelist1 = EventCode="1000|1001|11707|11724|104" whitelist2 = Type="^[Error|Critical]" </CODE></PRE> <P>1) Whitelists/blacklists can use only one format (standard or regular expression), not both at the same time: <A href="https://answers.splunk.com/answers/563657/wineventlog-whitelisting-by-sourcename-not-working.html">https://answers.splunk.com/answers/563657/wineventlog-whitelisting-by-sourcename-not-working.html</A><BR /> 2) Type must be the enum name not the value. I originally thought it would be the value because that's how it appears in XML.</P> Wed, 06 May 2020 19:26:38 GMT https://community.splunk.com/t5/Getting-Data-In/Monitor-Windows-Event-Log-for-Critical-Error/m-p/502992#M85678 tmontney 2020-05-06T19:26:38Z