topic Re: What is the proper syntax to whitelist a single EventCode from wineventlog security with a UF ? in Getting Data In

What is the proper syntax to whitelist a single EventCode from wineventlog security with a UF ?

Glasses — Mon, 19 Apr 2021 22:28:04 GMT

Hi -

Not having any luck testing or finding the answer in documentation so hopefully someone can confirm.

I want to collect a single EventCode=4624 from a Windows Server with a UF (v 8.0.6).

I am using an inputs.conf stanza like this>>>

#2021.4.19
[WinEventLog://Security]
disabled = 0
index=foo
whitelist1 = EventCode=4624

I am still collecting all wineventlog security EventCodes.

Any ideas?

TY!

Glasses — Mon, 19 Apr 2021 22:57:53 GMT

Even tried >>>

whitelist = 4624

no luck 😞

gcusello — Tue, 20 Apr 2021 06:51:19 GMT

whitelist and blacklist require regexes, so, please, try:

whitelist1 = EventCode\=4624

then, are your logs in json or normal format? if in json the regex is different.

Ciao.

Giuseppe

Glasses — Tue, 20 Apr 2021 17:50:45 GMT

Actually the issue was something with the UF not restarting splunkd.

This stanza does work now...

[WinEventLog://Security]
disabled = 0
index=foo
whitelist = 4624