Getting Data In

PowerShell Logging- Blacklist everything except Event Code 4104 & Level: Warning

New Member

We are attempting to ingest server powershell logging into Splunk. We found that ingest all the data was noisy and want to reduce the data ingested to what we really care about. Our goal is to only ingest Event Code 4104 with the level: Warning.

Is there a way to blacklist everything, and then whitelist only Event Code 4104 with the level: Warning?
We are ingesting via here: [WinEventLog://Microsoft-Windows-PowerShell/Operational]

0 Karma

Path Finder

inputs.conf -

Look at the Windows Event Log Monitor Section

Example from inputs.conf documentation:
whitelist = EventCode=%^200$% User=%jrodman%
Include events only if they have EventCode 200 and relate to User jrodman

Follow this pattern for your EventCode and Second Field you want to match

0 Karma