Let me interject here, @iamsahilshaiks For regex-based whitelisting it's not as simple as just puting the regex on its own. See https://docs.splunk.com/Documentation/Splunk/latest/admin/inputsconf#Event_Log_allow_list_and_deny_list_formats - you have to 1. Provide a key which will be matched against the regex 2. Enclose the regex in delimiters of your choice. So your example of whitelist = (?m)^4624$|^4625$ is completely wrong. Additionally, if you're exporting events as XML (which is currently the preferred way because traditional format tends to have some problems with parsing), you use XmlRegex key for filtering. splunk list monitor only list - as the name says - monitor type inputs which read files from the disk. Windows event log sources are not of monitor type. Last time I checked, grep was neither a standard CMD-usable tool nor a standard powershell cmdlet. And Windows doesn't use the $ notation for environment variables. As far as I remember, the events from Security log are not recast to another sourcetype. And actually your input stanza matches the "old way" of ingesting windows logs, which hasn't been used for several years now. Currently, the sourcetype for all windows logs should be WinEventlog or XmlWinEventlog depending on whether you're rendering them to XML or not. It's the source field which specifies the point of origin.
... View more
