Getting Data In

How to setup to whitelist and blacklist in inputs.conf to pull data from WinEventLog?

vin_ven27
Explorer

Hi, 

we are trying to pull a specific data from [WinEventLog://Microsoft-Windows-TaskScheduler/Operational] but the problem is our unique event is not suggested for the white/blacklisting such as eventID, category, etc... we only have Task Name to filter it. so we tried: 

blacklist = $XmlRegex=(?<=Name='TaskName'\>)(\\TaskNameSample\\)

and 

whitelist = $XmlRegex=(?<=Name='TaskName'\>)(\\TaskNameSample\\) 

but not working... do you have any suggested solution for this? 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @vin_ven27,

I don't know if it's acceptable for you this workaround: you could filter events on the Indexers or (if present) on Heavy Forwarders following the instructions at https://docs.splunk.com/Documentation/Splunk/9.0.0/Forwarding/Routeandfilterdatad#Filter_event_data_...

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...