topic Similar EventIds been taken in splunk in Splunk Search

Similar EventIds been taken in splunk

agupta2607 — Wed, 30 Sep 2020 01:38:50 GMT

Hi All,

My inputs conf are as follows
[WinEventLog://Application]
disabled = 0
whitelist = EventCode="26|25|19"
whitelist1 = SourceName="DWMRCS"
index = wineventlog
evt_resolve_ad_obj = 0
checkpointInterval = 5

Result : Getting all events which include 26 ,25,19
i.e. 326,1026,1025,10025,259,258, and more.

I also tried
[WinEventLog://Application]
disabled = 0
whitelist = EventCode="^26$|^25$|^19$"
whitelist1 = SourceName="DWMRCS"
index = wineventlog
evt_resolve_ad_obj = 0
checkpointInterval = 5

But same results.

Thanks In Advance

Re: Similar EventIds been taken in splunk

jaime_ramirez — Tue, 06 Aug 2019 20:26:04 GMT

Have you tried the following?:

[WinEventLog://Application]
disabled = 0
whitelist = 26,25,19
whitelist1 = SourceName="DWMRCS"
index = wineventlog
evt_resolve_ad_obj = 0
checkpointInterval = 5

Hope it helps!!!

Re: Similar EventIds been taken in splunk

agupta2607 — Wed, 07 Aug 2019 12:23:34 GMT

yes, I have tries this but does not work.

With my config, I just need to get the regex to get the exact EventCode.

Re: Similar EventIds been taken in splunk

agupta2607 — Mon, 26 Aug 2019 11:28:15 GMT

Have someone faced the same issue?

Re: Similar EventIds been taken in splunk

diogofgm — Mon, 26 Aug 2019 12:23:07 GMT

You can use ranges of event ids in white and blacklist without the regex

Example:

[WinEventLog://Application]
disabled = 0
start_from = oldest
current_only = 0
evt_resolve_ad_obj = 1
checkpointInterval = 5
# only index events with these event IDs.
whitelist = 0-2000,3001-10000
# exclude these event IDs from being indexed.
blacklist = 2001-3000

More information from docs:
https://docs.splunk.com/Documentation/Splunk/7.3.1/Data/MonitorWindowseventlogdata#Configuration_settings_for_monitoring_Windows_Event_Logs