Windows XML Filtering with $XmlRegex doesn't work on every machine

[CallumP]

I have two separate deployment apps going to separate classes. One we'll call A is working great with full event filtering and blacklisting via $XmlRegex in inputs.conf see below:

whitelist1 = $XmlRegex="<EventID>(1|12|13|6|1100|4624|4625|4634|4648|4663|4672|4688|4719|4722|4724|4732|4733|4735|4737|4739|4778|4779|4946|5140)<\/EventID>"
blacklist1 = $XmlRegex="<EventID>4688<\/EventID>.*<Data Name='NewProcessName'>[C-F]:\\Program Files\\Splunk(?:UniversalForwarder)?\\bin\\(?:btool|splunkd|splunk|splunk-(?:MonitorNoHandle|admon|netmon|perfmon|powershell|regmon|winevtlog|winhostinfo|winprintmon|wmi))\.exe"

This is under the WinEventLog stanza. I've now copied this over to class B with more hosts but this whitelist / blacklist isn't working. Our license is getting hit hard by the 4688 events and so need to trim them down considerably.

I've read other similar questions but we're using Xml Windows logs so classic responses don't work, I have also tried outright blocking it with props and transforms on our intermediate heavy forwarder with no success there either so either inputs or props and transforms help would be great

[scelikok · Accepted solution]

Hi @CallumP,

Splunk_TA_windows app already has blacklist1 and blacklist2. Please try with blacklist3 lie below. 

The difference between serverclasses maybe Splunk_TA_windows app existence.

whitelist3 = $XmlRegex="<EventID>(1|12|13|6|1100|4624|4625|4634|4648|4663|4672|4688|4719|4722|4724|4732|4733|4735|4737|4739|4778|4779|4946|5140)<\/EventID>"
blacklist3 = $XmlRegex="<EventID>4688<\/EventID>.*<Data Name='NewProcessName'>[C-F]:\\Program Files\\Splunk(?:UniversalForwarder)?\\bin\\(?:btool|splunkd|splunk|splunk-(?:MonitorNoHandle|admon|netmon|perfmon|powershell|regmon|winevtlog|winhostinfo|winprintmon|wmi))\.exe"

[AL3Z]

Hi @scelikok ,

Why is everything associated with EventCode="4688" being blocked after applying this Regex blacklist?

blacklist3 = $XmlRegex="<EventID>4688<\/EventID>.*<Data Name=('NewProcessName'|'ParentProcessName')>[C-F]:\\Program Files\\Splunk(?:UniversalForwarder)?\\bin\\(?:btool|splunkd|splunk|splunk-(?:MonitorNoHandle|admon|netmon|perfmon|powershell|regmon|winevtlog|winhostinfo|winprintmon|wmi))\.exe"