Getting Data In

inputs.conf Windows event whitelist

New Member

Hi guys,
it seems there's something wrong with my inputs.conf whitelist configuration :

[WinEventLog://System]
index = winsecevents
disabled = 0
start_from = oldest
current_only = 0
checkpointInterval = 5
renderXml = true
whitelist = EventCode="^104$" TaskCategory="^Log\sclear"

I tried of course with :
whitelist = EventCode="104" TaskCategory="Log clear"
or with the "message" conf like this one :

whitelist = EventCode="104" Message=".+log\sfile\swas\scleared."

But nothing has changed.
Do you have some ideas?
Thanks a lot.

0 Karma

New Member

Ok,I understood why it doesn't works.
I have renderXml=true and if I check the windows event,there's not any field i was looking for.
I must change the logic,parsing the raw xml and looking through it.

0 Karma

SplunkTrust
SplunkTrust

Hi
from https://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf

whitelist = <regular expression>
* If set, files from this input are monitored only if their path matches the
  specified regex.
* Takes precedence over the deprecated '_whitelist' setting, which functions
  the same way.
* Default: Not set.

So check the regex with your logs escaping all special chars (as = or ") , it should be something like this:

whitelist = EventCode\=104.*TaskCategory\=Log\sclear

Ciao.
Giuseppe

0 Karma

New Member

Ciao Giuseppe,
thanks for your comment.
I think i'm missing something...just to be clear,I'm trying to filter windows event logs and not custom.
In another stanza I have these settings that are running correctly :

[WinEventLog://Security]
index = winsecevents
disabled = 0
start_from = oldest
current_only = 0
evt_resolve_ad_obj = 1
checkpointInterval = 5
blacklist1 = EventCode="4662|566" Message="Object Type:(?!\s*groupPolicyContainer)"
blacklist2 = EventCode="4634|4624" Message="Logon Type:\s+3"
blacklist3 = EventCode="4648|4658" Message="Process Name:\s+C:\Program\sFiles\Microsoft\sAzure\sAD\sSync\Bin\miiserver.exe"
renderXml=true

The difference is just the keyword "blacklist" instead of "whitelist" but this one :
whitelist = EventCode="104" TaskCategory=".*Log\sclear"
or this :
whitelist = EventCode="104" Message=".+\slog\sfile\swas\scleared."

looks totally correct to me.
Thanks.

0 Karma

Contributor
whitelist = EventCode=%^104$%

Try this edit and restart the Splunk, I hope this will help!

0 Karma

Contributor

props.conf

  [WinEventLog://System]
  TRANSFORMS-FilterEvent = FilterEvent

transforms.conf

 [FilterEvent]
 REGEX = EventCode="^104$" 
 DEST_KEY = queue
 FORMAT = nullQueue

Try this as well!

0 Karma

New Member

Hi there,the issue is related to the second part of the filter : taskcategory/message (they are on the same line but the post has been modified.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!