How to blacklist specific occurrences of a particular eventcode?

[jh007]

I am attempting to blacklist a series of process creation events (eventcode 4688) because they are noise and will break my index cap. In short, I need to be able to keep 4688 events while filtering out the garbage. Here is what I have so far:

blacklist1 = EventCode="4688" Message="(.*splunk.*|.*WmiP.*|.*SearchFilterHost.*|.*taskhost.*|.*TrustedInstaller.*|.*dllhost.*).*.exe"

Any help would be greatly appreciated.

[gcusello]

Hi jh007,
you could filter these events on the indexer before indexing:
in props.conf

TRANSFORMS-set-AS=set_AS,set_nullqueue

in transforms.conf

# nullqueue #
[set_nullqueue]
REGEX=EventCode\=4688
DEST_KEY=queue
FORMAT=nullQueue
# AS #
[set_AS]
REGEX=.
DEST_KEY = queue
FORMAT = indexQueue

Beware how it's written EventCode=4688: if there are spaces or brackets modify my regex.

Bye.
Giuseppe

[jh007]

Hello Giuseppe,

I think you may of misunderstood what I was asking. I need to keep 4688 events except for the few specific ones I listed in my post. My issue has been figuring out how to make the blacklist acknowledge which components I want it to filter. All my previous attempts to filter specific 4688 events have stopped ALL 4688 events from coming in rather than ones I don't want. In summary, I need to know if there is in fact a way to blacklist what I am trying to do just like Splunk's documentation has suggested.

Thank you
James

[jh007]

Hello Giuseppe,

So I got the blacklist working for one event through the inputs.conf file. (see below)

blacklist1 = EventCode="4688" Message=".*[\S\s]*Account\sName:\s+[\S+]+[\$]"

Thank you for your help

[gcusello]

Hi jh007,
if your need is to take all events with 4688 except the ones you listed, you have to modify my transforms.conf (props.conf is the same) as following

 # nullqueue #
 [set_nullqueue]
 REGEX=Message\=\"(.*splunk.*|.*WmiP.*|.*SearchFilterHost.*|.*taskhost.*|.*TrustedInstaller.*|.*dllhost.*).*.exe\"
 DEST_KEY=queue
 FORMAT=nullQueue
 # AS #
 [set_AS]
 REGEX=EventCode\=4688
 DEST_KEY = queue
 FORMAT = indexQueue

Bye.
Giuseppe