I am working with a customer that is trying to narrow down their Windows Security logs. They would like to isolate the Event Code to only 4732,4624, while excluding Logon Type "3" and the list of Account Names. This stanza does not seem to be working and I was hoping someone might be able to assist with either cleaning it up or suggesting a better solution. [WinEventLog://Security] whitelist1 = 4732,4624 disabled = 0 followTail = 0 index = xxxxx ignoreOlderThan = 2d sourcetype=xxxx_wineventlog_sec blacklist1 = Message="Logon\sType:\s+(3|(\w+\$))" blacklist2 = Message="Account\sName:\s+(srvcy*|potalogp|micsperf|sssa|srvHPOM|srvc2cansible|(\w+\$))" Thank you. ... View more

Splunk 6.4.1 We have run into an issue on Tuesday where data for over 99 clients have just stopped presenting in the search. It looks like some of the data is reporting; however, there were 55 EventCodes displaying when I run index=* | stats count by EventCode at the time frame before the issue. Then there are only 6 EventCodes after that 1 minute time frame and since. I have been looking at my forwarders and they are all checking in. The _internal looks okay, with no errors. The serverclass is showing all the clients and nothing has changed on the inputs.conf. Splunkd.log also looks clean during that time frame on my search heads and indexers. I am quite green to Splunk and would appreciate any guidance on how to troubleshoot. I have also opened a Splunk case in parallel to help determine the issue. Thank you in advance. ... View more

We have a serverclass set up to ingest WinEventLog:Security logs for multiple servers (contains a blacklist for account names and ID's). The consumer is looking to add the WinEventLog:Directory Service logs for only (1) of the servers. Would we be able to accomplish this by having (2) server classes assigned to the one server? Or, is there a best practice solution for this type of scenario? Thank you in advance for any guidance. ... View more

I have been receiving numerous requests from my consumers on having their WinEventLog: sourcetypes changed to a custom sourcetype name. My question is this: What complications does this invite into my environment? I have heard on numerous forums that this is not a best practice and quite honestly not something that I am wanting to manage, but I want to speak my concerns with factual information when addressing my customers. Are there better ways for them to organize their environment without affecting changes to pre-trained sourcetypes: Tags? Lookups? Any advice and guidance as always is very much appreciated. ... View more

I am trying to remove generic service account names from the Windows Security log, so that we can focus on indexing only the specific user accounts. Am I missing something in my inputs.conf? [WinEventLog://Security] disabled = 0 index = "index" sourcetype = "sourcetype" blacklist = Account_Name=name1| name2|name3|name4|name5 Thank you in advance. ... View more

Using Splunk 6.4.1 I am trying to monitor the WinEventLog://Security; however, I only need to monitor two EventCodes (4732 and 4624). Additionally, we are looking to remove all service accounts from the indexing. (i.e. NT AUTHORITY, kerberos, etc...) I had tried using a black/white list with no luck and now I am working through trying to utilize transforms.conf. Any help would be appreciated. ... View more