Somobody has experience with filtering (supressing) Windows event using XML in Splunk inputs.conf?
So I have XML to filter specific Events from logs. I can't find in documentation stanza for adding XML in inputs.conf
Is it possible at all or only blacklisting?
Thank you
Hi @marcoatto
whitelist/blacklist are the only options to filter winevents, if your XML associated to a key ( Ex. EventCode) then using Regex you can filter them as defined in specs here - https://docs.splunk.com/Documentation/Splunk/8.2.1/admin/Inputsconf#Event_Log_allow_list_and_deny_li...
---
An upvote would be appreciated and Accept solution if it helps!