Is there any way to monitor System Event Viewer logs ( [WinEventLog://System] ) for Event Level set to "Critical" and/or "Error" only (Level =1 or 2) ?
It appears Splunk should allow you to whitelist based on Type, which is the field/key where the level is sent.
I would start with:
whitelist = Type="^[1|2]"
@danielransell , confirmed. I was able to test it yesterday: used "whitelist = Type = "Error" " in our test environment
I think you want to look at whitelisting for this. I have blacklisted certain event codes when ingesting security logs - I believe you can also perform whitelisting, that is on ingest events that meet a particular criteria.
@danielransell we whitelist Event Codes , for example. But cannot find any mentioning on how to whitelist Levels (Critical, Error)
To whitelist levels, you would need to create a whitelist regex. you should be able to mix event IDs and regex with separate lines like so:
whitelist1 = <list of eventIDs> whitelist2 = key=regex [key=regex]
@ jconger , it's not clear to me what you mean. can you , please, give more details or examples?
We are trying to get errors no matter what event ID is.