Please help with how do I get a list of all Windows event codes that are being ingested into Splunk Ent. ? Thx a million

[SamHTexas]

How do I get a list of all Windows event codes being ingested into Splunk please?

[ashvinpandey]

@SamHTexas Use the below query after adding your index and sourcetype:

Run this in the smart mode and timerange for around 7 days or 30 days if possible to get the total list

| search EventCode="*" | stats count by EventCode

Also, If this reply helps you, an upvote would be appreciated.

[bray1111]

Are you asking for what you have defined in inputs.conf as far as deny or do you want to find what event codes have been ingested?

This question/answer covers the inputs entries related to denies. https://community.splunk.com/t5/Getting-Data-In/How-to-create-more-than-10-blacklists-for-the-same-i...

this search should give you a breakdown of event codes with counts per code.

index=wineventlog
| stats count by EventCode

You'll probably want to expand on that using other fields like source and Name to better understand the codes.