Deployment Architecture

Why do I see events for Windows event codes other than what is wanted with my current configuration?

Communicator

I am getting back event codes (6013, 7002, 7036, 7040), but none for 1025 which is the only one I expected to find.
In the deployment-apps directory, I have a configuration that contains the following stanzas:

OS Logs
[WinEventLog://Security]
disabled = 0
start_from = oldest
current_only = 1
evt_resolve_ad_obj = 1
checkpointInterval = 5
whitelist1 = EventCode="1025" Message="Object Type:\s+(?!groupPolicyContainer)"
index = wineventlog_ivr
renderXml=false

[WinEventLog://System]
disabled = 0
start_from = oldest
current_only = 1
checkpointInterval = 5
whitelist1 = EventCode="1025" Message="Object Type:\s+(?!groupPolicyContainer)"
index = wineventlog_ivr
renderXml=false

###### Scripted Input (See also wmi.conf)
[script://$SPLUNK_HOME\etc\apps\Splunk_TA_windows\bin\win_listening_ports.bat]
disabled = 0
## Run once per hour
interval = 3600
sourcetype = Script:ListeningPorts
index = windows
0 Karma
1 Solution

Communicator

The stanzas are fine. It is a requirements issue. I needed:
[WinEventLog://Application]
disabled = 0
start_from = oldest
current_only = 1
evt_resolve_ad_obj = 1
checkpointInterval = 5
whitelist = 1025
whitelist1 = Message="Object Type:s+(?!groupPolicyContainer)"
index = wineventlog_ivr
renderXml=false

View solution in original post

0 Karma

Communicator

The stanzas are fine. It is a requirements issue. I needed:
[WinEventLog://Application]
disabled = 0
start_from = oldest
current_only = 1
evt_resolve_ad_obj = 1
checkpointInterval = 5
whitelist = 1025
whitelist1 = Message="Object Type:s+(?!groupPolicyContainer)"
index = wineventlog_ivr
renderXml=false

View solution in original post

0 Karma

Splunk Employee
Splunk Employee

Have you first tried the built in event id filtering? You also might want to remove the Message key first just to make sure the filtering works by itself.

Format would be: whitelist = 1025

So in your security logs example:

[WinEventLog://Security]
disabled = 0
start_from = oldest
current_only = 1
evt_resolve_ad_obj = 1
checkpointInterval = 5
whitelist = 1025
index = wineventlog_ivr
renderXml=false

Then if that works, you can add back the Message filter:

[WinEventLog://Security]
disabled = 0
start_from = oldest
current_only = 1
evt_resolve_ad_obj = 1
checkpointInterval = 5
whitelist = 1025
whitelist1 = Message="Object Type:\s+(?!groupPolicyContainer)"
index = wineventlog_ivr
renderXml=false

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!