I have made the following changes in my inputs.conf. However no luck
Could anyone help me with this?
However the above whitelist filter did not work at all. Specifically I dont want Eventcode 4674 events. So I have omitted it in whitelist.But events with 4674 are not getting filtered.
Do I need to specify blacklist?
Do I mention like this "Eventcode=4566" ?
Do I use anyother stanza to achieve this?
Thanks in advance.
As you've not mentioned it, did you check that the UF installed on that machine is actually version 6?
Found my problem.. between events I had one entry with two commas in a row, which made it not work.. all good.
Many thanks for the reply.
Yes. I have tried both whitelist and blacklist.
Still the filter did not work.
I have also tried to include evt_resolve_ad_obj = 1 in my inputs.conf.
However that also doesn't seem to work.
Could anyone please suggest any other possibilities to filter events based on event codes?
Same problem.. whitelisting doesn't work. I would think that if you whitelist certain events everything else is blocked but not working for me either.
Have you tried using
blacklist instead of
There's a good blog you can read here: http://blogs.splunk.com/2013/10/14/windows-event-logs-in-splunk-6/