inputs.conf Windows event whitelist

[isolsplunk]

Hi guys,
it seems there's something wrong with my inputs.conf whitelist configuration :

[WinEventLog://System]
index = winsecevents
disabled = 0
start_from = oldest
current_only = 0
checkpointInterval = 5
renderXml = true
whitelist = EventCode="^104$" TaskCategory="^Log\sclear"

I tried of course with :
whitelist = EventCode="104" TaskCategory="Log clear"
or with the "message" conf like this one :

whitelist = EventCode="104" Message=".+log\sfile\swas\scleared."

But nothing has changed.
Do you have some ideas?
Thanks a lot.

[isolsplunk]

Ok,I understood why it doesn't works.
I have renderXml=true and if I check the windows event,there's not any field i was looking for.
I must change the logic,parsing the raw xml and looking through it.

[gcusello]

Hi
from https://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf

whitelist = <regular expression>
* If set, files from this input are monitored only if their path matches the
  specified regex.
* Takes precedence over the deprecated '_whitelist' setting, which functions
  the same way.
* Default: Not set.

So check the regex with your logs escaping all special chars (as = or ") , it should be something like this:

whitelist = EventCode\=104.*TaskCategory\=Log\sclear

Ciao.
Giuseppe

[isolsplunk]

Ciao Giuseppe,
thanks for your comment.
I think i'm missing something...just to be clear,I'm trying to filter windows event logs and not custom.
In another stanza I have these settings that are running correctly :

[WinEventLog://Security]
index = winsecevents
disabled = 0
start_from = oldest
current_only = 0
evt_resolve_ad_obj = 1
checkpointInterval = 5
blacklist1 = EventCode="4662|566" Message="Object Type:(?!\s*groupPolicyContainer)"
blacklist2 = EventCode="4634|4624" Message="Logon Type:\s+3"
blacklist3 = EventCode="4648|4658" Message="Process Name:\s+C:\Program\sFiles\Microsoft\sAzure\sAD\sSync\Bin\miiserver.exe"
renderXml=true

The difference is just the keyword "blacklist" instead of "whitelist" but this one :
whitelist = EventCode="104" TaskCategory=".*Log\sclear"
or this :
whitelist = EventCode="104" Message=".+\slog\sfile\swas\scleared."

looks totally correct to me.
Thanks.

[sandeepmakkena]

whitelist = EventCode=%^104$%

Try this edit and restart the Splunk, I hope this will help!

[sandeepmakkena]

props.conf

  [WinEventLog://System]
  TRANSFORMS-FilterEvent = FilterEvent

transforms.conf

 [FilterEvent]
 REGEX = EventCode="^104$" 
 DEST_KEY = queue
 FORMAT = nullQueue

Try this as well!

[isolsplunk]

Hi there,the issue is related to the second part of the filter : taskcategory/message (they are on the same line but the post has been modified.