Getting Data In

Can I filter on MV field with 6.0+ UF?

Path Finder

Hello all!

In regards to the Windows Event Log filtering in the newer 6.0+ forwarders. I'm looking for some help on filtering out events what aren't required for us to keep and are really eating into our license usage. The event code is 4624 and I want to remove events where the second Secrurity_ID filed contains a "$" at the end.

I've tried the following with no luck and am wondering if this is even possible:

blacklist3 = EventCode=4624 Security_ID="NULL SID" Security_ID="DOMAIN*$"

From what I understand in the docs, for the event to be filtered out it needs to match all conditions of the blacklist. Based on my testing I am fairly certain this isn't the way to identify the second value of a field. Can anyone point me in the right direction to get this to work?

Thanks in advance!

0 Karma

Esteemed Legend

Do you have a blacklist1 and blacklist2, too? I don't think blacklist3 will work without them. If you don't, then try this (escaping the dollar sign, too):

blacklist1 = EventCode=4624 Security_ID="NULL SID" Security_ID="DOMAIN*\$"
0 Karma
Get Updates on the Splunk Community!

.conf23 | Get Your Cybersecurity Defense Analyst Certification in Vegas

We’re excited to announce a new Splunk certification exam being released at .conf23! If you’re going to Las ...

Streamline Data Ingestion With Deployment Server Essentials

REGISTER NOW!Every day the list of sources Admins are responsible for gets bigger and bigger, often making the ...

Remediate Threats Faster and Simplify Investigations With Splunk Enterprise Security ...

REGISTER NOW!Join us for a Tech Talk around our latest release of Splunk Enterprise Security 7.2! We’ll walk ...