Getting Data In

Blacklisting windows event logs based on EventCode and Application name


I am trying to filter the windows event based on the Application Name and EventCode.

Application_name I am trying to blacklist are splunkd.exe & zabbix_agentd.exe 

EventCode: 5156 & 5158

Sample Event: 

06/18/2020 10:00:28 PM
SourceName=Microsoft Windows security auditing.
TaskCategory=Filtering Platform Connection
Keywords=Audit Success
Message=The Windows Filtering Platform has permitted a connection.

Application Information:
Process ID: 8873
Application Name: \device\harddiskvolume2\program files\splunkuniversalforwarder\bin\splunkd.exe

Network Information:
Direction: Outbound
Source Address:
Source Port: 49346
Destination Address:
Destination Port: 8089
Protocol: 6

Filter Information:
Filter Run-Time ID: 66887
Layer Name: Connect
Layer Run-Time ID: 87

Inputs.conf on UF:

disabled = 0
start_from = oldest
current_only = 0
evt_resolve_ad_obj = 1
checkpointInterval = 5

I have tried the following different different blacklisting options under inputs.conf UF.

# Option 1:
blacklist1=EventCode="5156" Message=”Application Name:\s(?\device\harddiskvolume2\program files\zabbix agent\zabbix_agentd.exe)”
blacklist2=EventCode="5156" Message=”Application Name:\s(?\device\harddiskvolume2\program files\splunkuniversalforwarder\bin\splunkd.exe)”

blacklist3=EventCode="5158" Message=”Application Name:\s(?\device\harddiskvolume2\program files\zabbix agent\zabbix_agentd.exe)”
blacklist4=EventCode="5158" Message=”Application Name:\s(?\device\harddiskvolume2\program files\splunkuniversalforwarder\bin\splunkd.exe)”

# Option 2:

blacklist1=EventCode="5156" ”Application\sName:\s(?\device\harddiskvolume3\program files\splunkuniversalforwarder\bin\splunkd.exe)"
blacklist2=EventCode="5158" ”Application\sName:\s(?\device\harddiskvolume3\program files\splunkuniversalforwarder\bin\splunkd.exe)"

# Option 3:
blacklist1=EventCode=%^5158$% Message=%*zabbix_agentd.exe%
blacklist2=EventCode=%^5158$% Message=%*splunkd.exe%

# Option 4:
blacklist1=EventCode=%^5156$% Application Name=%(*\bin\splunkd.exe|*\zabbix_agentd.exe)%
blacklist2=EventCode=%^5158$% Application Name=%(*\bin\splunkd.exe|*\zabbix_agentd.exe)%

# Option 5:
blacklist1 = EventCode="5156" Application Name:"(*splunkd.exe|*zabbix_agentd.exe)"
blacklist2 = EventCode="5158" Application Name:"(*splunkd.exe|*zabbix_agentd.exe)"

# Option 6:
blacklist1=EventCode="5156" Message="Workstation Name:\s+*zabbix_agentd.exe*"
blacklist2=EventCode="5158" Message="Application Name:\s+*zabbix_agentd.exe*"

# Option 7: I have tried following under props & transforms on HF for routing the data to null queue.

On HF :
In props.conf,
TRANSFORMS-null= setnull

In transforms.conf
REGEX = (?s)EventCode=(5156|5158).*Application Name:\s.device.*\\splunkd.exe
DEST_KEY = queue
FORMAT = nullQueue

Unfortunately non of the above is working. Please suggest.

Thanks in advance.

Labels (1)
Tags (1)
0 Karma


Try this on the UF. 


blacklist1 = EventCode="^515[68]$" Message="Application\sName:\s(?:\\device\\harddiskvolume2\\program\sfiles\\zabbix\sagent\\zabbix_agentd\.exe|\\device\\harddiskvolume2\\program\sfiles\\splunkuniversalforwarder\\bin\\splunkd\.exe)$"


 If you do not want to use the full paths you could use:

blacklist1 = EventCode="^515[68]$" Message="Application\sName:\s.*(?:zabbix_agentd|splunkd)\.exe$"


0 Karma


Hi @spayneort , 

Thank you so much for your reply. Unfortunately, both the blacklist stanza did not work. I applied this under monitoring stanza of UF. 

disabled = 0
ignoreOlderThan = 7d
evt_resolve_ad_obj = 1
checkpointInterval = 5
index = win_event_logs
blacklist1= EventCode="^515[68]$" Message="Application\sName:\s.*(?:zabbix_agentd|splunkd)\.exe$"


Any suggestions. 

Tags (1)
0 Karma



Got this to work with similar syntax

blacklist1 = EventCode="^468[89]$" Message="Process Name:(.*?(SplunkUniversalForwarder|or_any_other_program))"


Note the following:

1. The | is an OR

2. This finds anything the starts with your program

3. be careful of spaces, sometimes they don't really exist

4. Don't use $ as you'll need a wild card to find what you're looking for, plus more processing power required.


Hope that helps!

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...