Trouble Ingesting Whitelisted Event Codes

[kymenope]

My inputs.conf looks like this

index = wineventlog

sourcetype = WinEventLog:Security

disabled = 0

whitelist = 1, 2, 3, 4, 5

blacklist1 = $XmlRegex="(?ms)<EventID>5156<\/EventID>.*<Data\sName='Application'>\\device\\harddiskvolume\d+\\program\sfiles\\splunkuniversalforwarder\\(bin\\splunkd\.exe|etc\\apps\\splunk_ta_stream\\windows_x86_64\\bin\\streamfwd\.exe)<.*<Data\sName='DestPort'>(9997|443|8000)<"

blacklist2 = $XmlRegex="(?ms)<EventID>5156<\/EventID>.*<Data\sName='DestAddress'>(127.0.0.1|::1|0:0:0:0:0:0:0:1|169.254.*?|fe80:.*?)<"

blacklist3 = $XmlRegex="(?ms)<EventID>4688<\/EventID>.*<Data\sName='NewProcessName'>C:\\Program Files\\SplunkUniversalForwarder\\(etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\streamfwd.exe|bin\\(splunk-powershell.exe|splunk-MonitorNoHandle.exe|splunk-netmon.exe|splunk-regmon.exe|splunkd.exe|btool.exe|splunk.exe|splunk-winevtlog.exe|splunk-admon.exe|splunk-perfmon.exe|splunk-winprintmon.exe|splunk-wmi.exe))<"

I confirmed that this config has been pushed to all forwarders, the forwarders are using the local system account, and that the firewall is not blocking anything.  Despite this the logs I am ingesting are unrelated to my explicit whitelist and are ~5% of what I am expecting to see.

Any ideas?

[kymenope · Accepted solution]

It appears that only one of my hosts is sending in security logs - the Splunk search head.  Verified all other hosts have received the inputs.conf and are running with the required level of permissions.  Don't see any windows firewall events which are blocking the outbound connection.