Whitelist for WinEventLog does not filter with two fields EventCode and Logon_Type

[gerdhuber]

Hallo,

i need help for this stanza. I want only Events for "EventCode=4624 and Logon_Type=10" .
Whitelist2 works fine.

[WinEventLog://Security]
disabled = false
start_from = oldest
evt_resolve_ad_obj = 0
checkpointInterval = 5
whitelist1 = EventCode=%^(4624)$% Logon_Type=%^10$%
whitelist2 = EventCode=%^(4625|4647|4720|4722|4724|4725|4726|4738|4781)$%
index = infrastrukturlog_windows

Thank you

Gerd

[gcusello]

Hi gerdhuber,
the easiest way is to filter events before indexing on Indexers, see http://docs.splunk.com/Documentation/Splunk/6.6.2/Forwarding/Routeandfilterdatad

Bye.
Giuseppe

[gerdhuber]

This works for me:

whitelist1 = EventCode=%^(4624)$% Message="Logon\sType:\t+10"
whitelist2 = EventCode=%^(4625|4647|4720|4722|4724|4725|4726|4738|4781)$%