I am getting back event codes (6013, 7002, 7036, 7040), but none for 1025 which is the only one I expected to find.
In the deployment-apps directory, I have a configuration that contains the following stanzas:
[WinEventLog://Security]
disabled = 0
start_from = oldest
current_only = 1
evt_resolve_ad_obj = 1
checkpointInterval = 5
whitelist1 = EventCode="1025" Message="Object Type:\s+(?!groupPolicyContainer)"
index = wineventlog_ivr
renderXml=false
[WinEventLog://System]
disabled = 0
start_from = oldest
current_only = 1
checkpointInterval = 5
whitelist1 = EventCode="1025" Message="Object Type:\s+(?!groupPolicyContainer)"
index = wineventlog_ivr
renderXml=false
###### Scripted Input (See also wmi.conf)
[script://$SPLUNK_HOME\etc\apps\Splunk_TA_windows\bin\win_listening_ports.bat]
disabled = 0
## Run once per hour
interval = 3600
sourcetype = Script:ListeningPorts
index = windows
The stanzas are fine. It is a requirements issue. I needed:
[WinEventLog://Application]
disabled = 0
start_from = oldest
current_only = 1
evt_resolve_ad_obj = 1
checkpointInterval = 5
whitelist = 1025
whitelist1 = Message="Object Type:s+(?!groupPolicyContainer)"
index = wineventlog_ivr
renderXml=false
The stanzas are fine. It is a requirements issue. I needed:
[WinEventLog://Application]
disabled = 0
start_from = oldest
current_only = 1
evt_resolve_ad_obj = 1
checkpointInterval = 5
whitelist = 1025
whitelist1 = Message="Object Type:s+(?!groupPolicyContainer)"
index = wineventlog_ivr
renderXml=false
Have you first tried the built in event id filtering? You also might want to remove the Message key first just to make sure the filtering works by itself.
Format would be: whitelist = 1025
So in your security logs example:
[WinEventLog://Security]
disabled = 0
start_from = oldest
current_only = 1
evt_resolve_ad_obj = 1
checkpointInterval = 5
whitelist = 1025
index = wineventlog_ivr
renderXml=false
Then if that works, you can add back the Message filter:
[WinEventLog://Security]
disabled = 0
start_from = oldest
current_only = 1
evt_resolve_ad_obj = 1
checkpointInterval = 5
whitelist = 1025
whitelist1 = Message="Object Type:\s+(?!groupPolicyContainer)"
index = wineventlog_ivr
renderXml=false