Getting Data In

How to filter out a Windows Event Code if the event from a user repeats over a period of time?

hartfoml
Motivator

I want to capture Windows Event Logs EventCode 4673 when it happens once for each user over a period of one hour. If a single user generates this Event Code 100 times in one hour I would like to record it only once in Splunk.

If this is not doable, can I remove the payload suppress_text = 1 for this event only and not for all Windows Security Events?

0 Karma

woodcock
Esteemed Legend

Assuming that you have a field called user, you can do it at search-time with:

... | dedup EventCode user ...

However I do not know of any way to do it at index-time. Also, you cannot selectively suppress_text; it applies to the entire stanza (which can selectively apply to EventCodes by using whitelist and blacklist). Also you can only use a specific WinEventLog stanza header once; if you duplicate any, only the last one in the file will be used (all others ignored). If you really need to re-use a stanza header, you will have to stand up multiple Splunk instances on your forwarder so each has a different configuration.

0 Karma

hartfoml
Motivator

Hi @woodcock, Thanks for your suggestion and comment. The requierment is to reduce index on this event without eliminating it. I think I can add more than one blacklist item for the WinEventLog stanza so If i wanted to blacklist with regex or "EventCode=" I could just use blacklist1= blacklist2= etc. This would alow me to filter out all events for the EventCode at index time. I waas hopeing to get some but filter out most.

Thanks again for your help.

0 Karma

woodcock
Esteemed Legend

No; blacklist is all-or-none.

0 Karma

maciep
Champion

I can't think of any way to inherently accomplish that. Typically that kind of logic would get applied at search time. But if that's not an option for you, then maybe just blacklist that event id (see blog post below). And then you could probably script something to accomplish your goal for that event id.

Event Logs in Splunk 6

0 Karma

hartfoml
Motivator

@maciep thanks for the link to the blog. I read it and it was very helpful in understanding how to set up the UF for filtering out events before index.

Unfortunately this will not meet the requirement. I will look into scripting something to do the filtering.

Thanks much for the suggestion.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...