Getting Data In

Why is blacklist with filter on windows event logs not working?

New Member


I have a requirement to blacklist all  computer accounts (ending with $) in Security Event Code 4769. So far I have created following filter in inputs.conf but it is not working.



disabled = 0
renderXml = 1
source = XmlWinEventLog:Security
blacklist1 = EventCode="4769" Message="(?:<Data Name='ServiceName'>).+\$"



 I checked regex and it is working on regex builder App but filtering is not working. I am still receiving events with computer accounts.

I referred and tried out various splunk forum questions on the same but no luck. Any help will be appreciated.

Thanks for your time.

Labels (1)
0 Karma


@catchvjay You may try this  :
blacklist1 = EventCode="4769"  Message="Account Name:(\W+\w+$)"

0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...

Security Newsletter Updates | March 2023

 March 2023 | Check out the latest and greatestUnify Your Security Operations with Splunk Mission Control The ...