https://community.splunk.com/t5/Getting-Data-In/Filter-exported-EVTX-files-event-codes/m-p/346226#M94894 <P>What regular expression you used for whitelistiing? Also you can try out filtering events queues., refer below docs:<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/7.0.3/Forwarding/Routeandfilterdatad#Keep_specific_events_and_discard_the_rest">http://docs.splunk.com/Documentation/Splunk/7.0.3/Forwarding/Routeandfilterdatad#Keep_specific_events_and_discard_the_rest</A></P> Tue, 17 Apr 2018 05:28:50 GMT p_gurav 2018-04-17T05:28:50Z https://community.splunk.com/t5/Getting-Data-In/Filter-exported-EVTX-files-event-codes/m-p/346225#M94893 <P>I was wondering if there is a way to filter the event codes when you try to index exported EVTX, I've tried with whitelist with no luck.</P> <P>Any help will be highly appreciated.</P> Tue, 17 Apr 2018 02:47:15 GMT https://community.splunk.com/t5/Getting-Data-In/Filter-exported-EVTX-files-event-codes/m-p/346225#M94893 jpbonilla 2018-04-17T02:47:15Z https://community.splunk.com/t5/Getting-Data-In/Filter-exported-EVTX-files-event-codes/m-p/346226#M94894 <P>What regular expression you used for whitelistiing? Also you can try out filtering events queues., refer below docs:<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/7.0.3/Forwarding/Routeandfilterdatad#Keep_specific_events_and_discard_the_rest">http://docs.splunk.com/Documentation/Splunk/7.0.3/Forwarding/Routeandfilterdatad#Keep_specific_events_and_discard_the_rest</A></P> Tue, 17 Apr 2018 05:28:50 GMT https://community.splunk.com/t5/Getting-Data-In/Filter-exported-EVTX-files-event-codes/m-p/346226#M94894 p_gurav 2018-04-17T05:28:50Z