Getting Data In

How to setup to whitelist and blacklist in inputs.conf to pull data from WinEventLog?

vin_ven27
Explorer

Hi, 

we are trying to pull a specific data from [WinEventLog://Microsoft-Windows-TaskScheduler/Operational] but the problem is our unique event is not suggested for the white/blacklisting such as eventID, category, etc... we only have Task Name to filter it. so we tried: 

blacklist = $XmlRegex=(?<=Name='TaskName'\>)(\\TaskNameSample\\)

and 

whitelist = $XmlRegex=(?<=Name='TaskName'\>)(\\TaskNameSample\\) 

but not working... do you have any suggested solution for this? 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @vin_ven27,

I don't know if it's acceptable for you this workaround: you could filter events on the Indexers or (if present) on Heavy Forwarders following the instructions at https://docs.splunk.com/Documentation/Splunk/9.0.0/Forwarding/Routeandfilterdatad#Filter_event_data_...

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...

The Visibility Gap: Hybrid Networks and IT Services

The most forward thinking enterprises among us see their network as much more than infrastructure – it's their ...

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...