All Apps and Add-ons

not able to whitelist windows events logs

jitendrasingh12
Explorer

Dear All ,

          i am using below inputs.conf to white list few windows event logs that i only need for my syslog . Rest i want to drop but some how its not working fine for me ..Request help on this from you..

[WinEventLog://Security]
disabled = 0
start_from = oldest
current_only = 0
evt_resolve_ad_obj = 1
checkpointInterval = 5
whitelist = 624,627,629,630,1100,1102,1104,4616,4618,4698,4720,4723,4724,4725,4726,4733,4734,4735,4739,4740
index = wineventlog
renderXml=false

http://blogs.splunk.com/2013/10/14/windows-event-logs-in-splunk-6/

http://answers.splunk.com/answers/152131/filter-windows-eventcode-using-blacklist-and-whitelist.html

javiergn
Super Champion

Hi,

Can you run btool and tell us exactly what your Security stanza looks like?

./splunk cmd btool inputs list --debug

http://docs.splunk.com/Documentation/Splunk/latest/Troubleshooting/Usebtooltotroubleshootconfigurati...

There might be other apps conflicting with yours.

By the way, when you say "somehow it's not working fine for me", can you be more specific?

Thanks,
J

mendesjo
Path Finder

same problem, every find an answer?

0 Karma

mendesjo
Path Finder

My issue was in my whitelist line I had 2 commas together at one point. After I found that it works as expected.

0 Karma

somesoni2
Revered Legend

Look at Test 3 (traditional filtering) from the highest voted answer from below post.

https://answers.splunk.com/answers/152131/filter-windows-eventcode-using-blacklist-and-whitelist.htm...

0 Karma

mendesjo
Path Finder

I found my issue.. I had a long list of event codes and I had two commas together.. UGGG! but that was my issue. Thanks for the reply.

0 Karma
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...