Filtering Windows Events using XML in inputs.conf - Splunk Community

Getting Data In

Somobody has experience with filtering (supressing) Windows event using XML in Splunk inputs.conf?

So I have XML to filter specific Events from logs. I can't find in documentation stanza for adding XML in inputs.conf

Is it possible at all or only blacklisting?

Thank you

whitelist/blacklist are the only options to filter winevents, if your XML associated to a key ( Ex. EventCode) then using Regex you can filter them as defined in specs here - https://docs.splunk.com/Documentation/Splunk/8.2.1/admin/Inputsconf#Event_Log_allow_list_and_deny_li...

---

An upvote would be appreciated and Accept solution if it helps!

Get Updates on the Splunk Community!

New Year. New Skills. New Course Releases from Splunk Education

A new year often inspires reflection—and reinvention. Whether your goals include strengthening your security ...

Splunk and TLS: It doesn't have to be too hard

Overview Creating a TLS cert for Splunk usage is pretty much standard openssl. To make life better, use an ...

Faster Insights with AI, Streamlined Cloud-Native Operations, and More New Lantern ...

Splunk Lantern is a Splunk customer success center that provides practical guidance from Splunk experts on key ...