topic Unable to whitelist only Error EventID's sent from UF to Indexer in Getting Data In

Unable to whitelist only Error EventID's sent from UF to Indexer

sneha_nv — Tue, 08 Sep 2020 07:33:12 GMT

Hi Team,

From Windows Event Viewer logs we can onboard all Event ID's generated for "Application" and "System" Event logs but unable to onboard filtered events based on Event Code OR Type(Error/Warning).

Below is inputs.conf written by me to filter-out the events which is not working.Also followed the below splunk docs.

[WinEventLog ://Application]

disabled = 0

whitelist = Type="^[Error|Critical]"

index = test

[WinEventLog://Application]

disabled = 0

whitelist = EventCode="1001|11707"

index = test

[WinEventLog://System]
disabled = 0
whitelist 1 = Event Code=7011
whitelist 2 = Type="^[Error|Critical]"
index = test

https://community.splunk.com/t5/Getting-Data-In/Monitor-Windows-Event-Log-for-Critical-Error/td-p/502991

https://docs.splunk.com/Documentation/SplunkCloud/8.0.2006/Data/MonitorWindowseventlogdata

Please check with your seniors on How can we whitelist only Error events in Application or System Event logs. Please find the attachement

Re: Unable to whitelist only Error EventID's sent from UF to Indexer

thambisetty — Tue, 08 Sep 2020 11:11:31 GMT

try below:

[WinEventLog://Application] disabled = 0 whitelist = EventCode="^(1001|11707)$" index = test

[WinEventLog://System] disabled = 0 whitelist1 = EventCode="7011" #no space between whitelist and number whitelist2 = Type="^(Error|Critical)$" index = test

Re: Unable to whitelist only Error EventID's sent from UF to Indexer

sneha_nv — Tue, 08 Sep 2020 11:17:50 GMT

Also If I don't know the error Eventcode and only based on Type(Error/Warning) want to collect the "Application" and "Sysytem" logs

What will be my inputs.conf in this scenario while on-boarding data from UF to Indexer

Re: Unable to whitelist only Error EventID's sent from UF to Indexer

sneha_nv — Mon, 14 Sep 2020 06:47:18 GMT

it worked for me

[WinEventLog://System]
disabled = 0
whitelist1 = Type="^[Error]"
whitelist2 = Type="^[Critical]"
whitelist3 = Type="^[Warning]"
index = test

[WinEventLog://Application]

disabled = 0

whitelist1 = Type="^[Error]"

whitelist2 = Type="^[Critical]"

whitelist3 = Type="^[Warning]"

index = test

Re: Unable to whitelist only Error EventID's sent from UF to Indexer

thambisetty — Mon, 14 Sep 2020 07:17:28 GMT

I suggest you to replace [] with (), characters between [] will match individually for example

[Error] - matches E or r or r or o or r anywhere in the event.

(Error) -matches only Error