How to setup to whitelist and blacklist in inputs.conf to pull data from WinEventLog?

[vin_ven27]

Hi, 

we are trying to pull a specific data from [WinEventLog://Microsoft-Windows-TaskScheduler/Operational] but the problem is our unique event is not suggested for the white/blacklisting such as eventID, category, etc... we only have Task Name to filter it. so we tried: 

blacklist = $XmlRegex=(?<=Name='TaskName'\>)(\\TaskNameSample\\)

and 

whitelist = $XmlRegex=(?<=Name='TaskName'\>)(\\TaskNameSample\\) 

but not working... do you have any suggested solution for this? 

[gcusello]

Hi @vin_ven27,

I don't know if it's acceptable for you this workaround: you could filter events on the Indexers or (if present) on Heavy Forwarders following the instructions at https://docs.splunk.com/Documentation/Splunk/9.0.0/Forwarding/Routeandfilterdatad#Filter_event_data_...

Ciao.

Giuseppe