topic Re: XML - WinEvent Whitelist in Dashboards & Visualizations

XML - WinEvent Whitelist

cstewart28 — Wed, 30 Sep 2020 03:22:11 GMT

I have see other example, but non using XML for the whitelist. I only have a 2GB license and I have to go very slow at what I collect and add in event ID until I reach close to the max. I look at my index and I see a bunch of other event ids, what did I do wrong?

[WinEventLog://Security]
disabled = 0
start_from = oldest
current_only = 0
evt_resolve_ad_obj = 1
checkpointInterval = 5
whitelist= $XmlRegex= EventCode="106, 4624, 4625"
renderXml = true
index = xmlwineventlog

Re: XML - WinEvent Whitelist

richgalloway — Thu, 12 Dec 2019 15:41:44 GMT

Not sure, but I think whitelist = 106,4624,4625 should work.

Re: XML - WinEvent Whitelist

woodcock — Sun, 15 Dec 2019 07:33:05 GMT

Here are the docs:
https://docs.splunk.com/Documentation/Splunk/latest/Data/MonitorWindowseventlogdata#Use_blacklists_and_whitelists_to_filter_on_XML-based_events
Try this (assuming the events have the strings Eventcode=106, Eventcode=4624, andEventcode=4625.

whitelist= $XmlRegex= EventCode=(106|4624|4625)

Re: XML - WinEvent Whitelist

BDein — Tue, 25 Oct 2022 11:00:54 GMT

@richgalloway your whitelist = 106,4624,4625 will not work as long renderXml = true according to the documentation.

With renderXml = true you need to use: $XmlRegex