Getting Data In

How to blacklist application event level "Information" on Windows 2012 servers?

sim_tcr
Communicator

Hello,

How to blacklist application event Level "Information" on Windows 2012 servers.

Already tried:

[WinEventLog:Application]
blacklist = EventType=Information
sourcetype = applicationerrors
disabled = 0
index = osgpp
disabled = false
crcSalt=

[WinEventLog:Application]
blacklist = EventType=0
sourcetype = applicationerrors
disabled = 0
index = osgpp
disabled = false
crcSalt=

1 Solution

sim_tcr
Communicator
[WinEventLog://Application]
blacklist = Type="(Information)"
sourcetype = applicationerrors
disabled = 0
index = osgpp
disabled = false
crcSalt=<SOURCE>

Above fixed my issue

View solution in original post

sim_tcr
Communicator
[WinEventLog://Application]
blacklist = Type="(Information)"
sourcetype = applicationerrors
disabled = 0
index = osgpp
disabled = false
crcSalt=<SOURCE>

Above fixed my issue

View solution in original post

spayneort
Contributor

Try changing it to:

[WinEventLog://Application]

instead of:

[WinEventLog:Application]

0 Karma

sim_tcr
Communicator

Tried below and made sure that forwarder was restarted after both changes. Still not working. Still getting Information events.
our server are windows 2012

[WinEventLog://Application]
blacklist = Type=0
sourcetype = applicationerrors
disabled = 0
index = osgpp
disabled = false
crcSalt=<SOURCE>

and

[WinEventLog://Application]
blacklist = Type=Information
sourcetype = applicationerrors
disabled = 0
index = osgpp
disabled = false
crcSalt=<SOURCE>
0 Karma

spayneort
Contributor

The EventType filter is for 2003 and earlier. Use Type for 2008 and later. The Microsoft documentation says that the numeric value for Type "Information" is 4.

http://docs.splunk.com/Documentation/Splunk/6.4.1/Data/MonitorWindowseventlogdata

Win32_NTLogEvent class

0 Karma

sim_tcr
Communicator

Tried below and made sure that forwarder was restarted after both changes. Still not working. Still getting Information events.

[WinEventLog://Application]
blacklist = EventType=0
sourcetype = applicationerrors
disabled = 0
index = osgpp
disabled = false
crcSalt=<SOURCE>

and

[WinEventLog://Application]
blacklist = EventType=Information
sourcetype = applicationerrors
disabled = 0
index = osgpp
disabled = false
crcSalt=<SOURCE>
0 Karma

woodcock
Esteemed Legend

This needs to be deployed to all your forwarders and the Splunk forwarder instance on those servers must be restarted. Even so, only events that are forwarded AFTER the restart will be effected; "wrong" events forwarded before will still be there. You can use the delete command to hide them.

0 Karma

yonick
Engager
0 Karma

sim_tcr
Communicator

But which one of them is correct?
I tried both.
Forwarders must have restarted whenever i deployed these. I pushed these through deployment server.

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.