All Apps and Add-ons

not able to whitelist windows events logs

jitendrasingh12
Explorer

Dear All ,

          i am using below inputs.conf to white list few windows event logs that i only need for my syslog . Rest i want to drop but some how its not working fine for me ..Request help on this from you..

[WinEventLog://Security]
disabled = 0
start_from = oldest
current_only = 0
evt_resolve_ad_obj = 1
checkpointInterval = 5
whitelist = 624,627,629,630,1100,1102,1104,4616,4618,4698,4720,4723,4724,4725,4726,4733,4734,4735,4739,4740
index = wineventlog
renderXml=false

http://blogs.splunk.com/2013/10/14/windows-event-logs-in-splunk-6/

http://answers.splunk.com/answers/152131/filter-windows-eventcode-using-blacklist-and-whitelist.html

javiergn
SplunkTrust
SplunkTrust

Hi,

Can you run btool and tell us exactly what your Security stanza looks like?

./splunk cmd btool inputs list --debug

http://docs.splunk.com/Documentation/Splunk/latest/Troubleshooting/Usebtooltotroubleshootconfigurati...

There might be other apps conflicting with yours.

By the way, when you say "somehow it's not working fine for me", can you be more specific?

Thanks,
J

mendesjo
Path Finder

same problem, every find an answer?

0 Karma

mendesjo
Path Finder

My issue was in my whitelist line I had 2 commas together at one point. After I found that it works as expected.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Look at Test 3 (traditional filtering) from the highest voted answer from below post.

https://answers.splunk.com/answers/152131/filter-windows-eventcode-using-blacklist-and-whitelist.htm...

0 Karma

mendesjo
Path Finder

I found my issue.. I had a long list of event codes and I had two commas together.. UGGG! but that was my issue. Thanks for the reply.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...