Getting Data In

Blacklist Windows Event ID 4769

Yadukrishnan
Explorer

Hi,

 

I am trying to blacklist Windows Event ID 4769 from a particular User ID. Is this possible to be implemented. 

 

I already added the following Blacklist but it didnt seem to work. 

blacklist = EventCode="4769" User="Account Name"

Tags (2)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

1. Where are you putting those settings to?

2. What format are you ingesting your eventlogs in?

 

0 Karma

Yadukrishnan
Explorer

I am making changes on  opt splunk etc apps splunk_ta_win local  inputs.conf. The Windows Event IDs are collected using Universal Forwarder. There is one another blacklist in the same configuration file which is working fine with out any issues.

0 Karma

PickleRick
SplunkTrust
SplunkTrust

OK.

How are you ingesting your events? key/value or XML?

Does the other (working) blacklist entry specify just the event code?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

"Seem"?  Either it worked or it didn't.

In which file did you add that line?  On which Splunk instance?  Did you restart Splunk after making the change?

---
If this reply helps you, Karma would be appreciated.
0 Karma

Yadukrishnan
Explorer

Didnt work. Yes, I have restarted the services after making the changes. 

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...