My inputs.conf looks like this   index = wineventlog sourcetype = WinEventLog:Security disabled = 0 whitelist = 1, 2, 3, 4, 5 blacklist1 = $XmlRegex="(?ms)<EventID>5156<\/EventID>.*<Data\sName='Application'>\\device\\harddiskvolume\d+\\program\sfiles\\splunkuniversalforwarder\\(bin\\splunkd\.exe|etc\\apps\\splunk_ta_stream\\windows_x86_64\\bin\\streamfwd\.exe)<.*<Data\sName='DestPort'>(9997|443|8000)<" blacklist2 = $XmlRegex="(?ms)<EventID>5156<\/EventID>.*<Data\sName='DestAddress'>(127.0.0.1|::1|0:0:0:0:0:0:0:1|169.254.*?|fe80:.*?)<" blacklist3 = $XmlRegex="(?ms)<EventID>4688<\/EventID>.*<Data\sName='NewProcessName'>C:\\Program Files\\SplunkUniversalForwarder\\(etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\streamfwd.exe|bin\\(splunk-powershell.exe|splunk-MonitorNoHandle.exe|splunk-netmon.exe|splunk-regmon.exe|splunkd.exe|btool.exe|splunk.exe|splunk-winevtlog.exe|splunk-admon.exe|splunk-perfmon.exe|splunk-winprintmon.exe|splunk-wmi.exe))<"   I confirmed that this config has been pushed to all forwarders, the forwarders are using the local system account, and that the firewall is not blocking anything.  Despite this the logs I am ingesting are unrelated to my explicit whitelist and are ~5% of what I am expecting to see. Any ideas? ... View more

My inputs.conf from the deployment server (confirmed that it is being pushed to all hosts correctly): {WinEventLog://Security}   index = wineventlog sourcetype = WinEventLog:Security disabled = 0 whitelist = EventCode="0-6000" blacklist = EventCode="1,2,3,4,"   Substituted other values for the blacklisted ones.  Despite being explicitly disallowed all host forwarders are still collecting and forwarding these events to the indexer.  Am I misconfiguring this? ... View more

Fairly new Splunk user here looking for Linux auditing solutions.  I am running a disconnected version of Splunk Enterprise and thus cannot make use of the content pack which replaced the application and add-on according to SplunkBase.  Am I still able to use the archived applications and add-on?  Realistically I am seeking a solution that would allow me to configure the universal forwarders I'm using to send the appropriate data so I can create queries via the linux_secure sourcetype. ... View more