not able to whitelist windows events logs

[jitendrasingh12]

Dear All ,

          i am using below inputs.conf to white list few windows event logs that i only need for my syslog . Rest i want to drop but some how its not working fine for me ..Request help on this from you..

[WinEventLog://Security]
disabled = 0
start_from = oldest
current_only = 0
evt_resolve_ad_obj = 1
checkpointInterval = 5
whitelist = 624,627,629,630,1100,1102,1104,4616,4618,4698,4720,4723,4724,4725,4726,4733,4734,4735,4739,4740
index = wineventlog
renderXml=false

http://blogs.splunk.com/2013/10/14/windows-event-logs-in-splunk-6/

http://answers.splunk.com/answers/152131/filter-windows-eventcode-using-blacklist-and-whitelist.html

[javiergn]

Hi,

Can you run btool and tell us exactly what your Security stanza looks like?

./splunk cmd btool inputs list --debug

http://docs.splunk.com/Documentation/Splunk/latest/Troubleshooting/Usebtooltotroubleshootconfigurati...

There might be other apps conflicting with yours.

By the way, when you say "somehow it's not working fine for me", can you be more specific?

Thanks,
J

[mendesjo]

same problem, every find an answer?

[mendesjo]

My issue was in my whitelist line I had 2 commas together at one point. After I found that it works as expected.

[somesoni2]

Look at Test 3 (traditional filtering) from the highest voted answer from below post.

https://answers.splunk.com/answers/152131/filter-windows-eventcode-using-blacklist-and-whitelist.htm...

[mendesjo]

I found my issue.. I had a long list of event codes and I had two commas together.. UGGG! but that was my issue. Thanks for the reply.