Unable to whitelist only Error EventID's sent from UF to Indexer

[sneha_nv]

Hi Team,

From Windows Event Viewer logs we can onboard all Event ID's generated for "Application" and "System" Event logs but unable to onboard filtered events based on Event Code OR Type(Error/Warning).

Below is inputs.conf written by me to filter-out the events which is not working.Also followed the below splunk docs.

[WinEventLog ://Application]

disabled = 0

whitelist = Type="^[Error|Critical]"

index = test

OR

[WinEventLog://Application]

disabled = 0

whitelist = EventCode="1001|11707"

index = test

[WinEventLog://System]
disabled = 0
whitelist 1 = Event Code=7011
whitelist 2 = Type="^[Error|Critical]"
index = test

https://community.splunk.com/t5/Getting-Data-In/Monitor-Windows-Event-Log-for-Critical-Error/td-p/50...

https://docs.splunk.com/Documentation/SplunkCloud/8.0.2006/Data/MonitorWindowseventlogdata

Please check with your seniors on How can we whitelist only Error events in Application or System Event logs. Please find the attachement

[sneha_nv]

it worked for me 

[WinEventLog://System]
disabled = 0
whitelist1 = Type="^[Error]"
whitelist2 = Type="^[Critical]"
whitelist3 = Type="^[Warning]"
index = test

[WinEventLog://Application]

disabled = 0

whitelist1 = Type="^[Error]"

whitelist2 = Type="^[Critical]"

whitelist3 = Type="^[Warning]"

index = test

[thambisetty]

I suggest you to replace [] with (), characters between [] will match individually for example

[Error] - matches E or r or r or o or r anywhere in the event.

(Error) -matches only Error

[sneha_nv]

Also If I don't know the error Eventcode and only based on Type(Error/Warning) want to collect the "Application" and "Sysytem" logs

What will be my inputs.conf in this scenario while on-boarding data from UF to Indexer

[thambisetty]

try below:

[WinEventLog://Application]
disabled = 0
whitelist = EventCode="^(1001|11707)$"
index = test

[WinEventLog://System]
disabled = 0
whitelist1 = EventCode="7011" #no space between whitelist and number
whitelist2 = Type="^(Error|Critical)$"
index = test