Getting Data In

How to monitor [WinEventLog://System] event logs for "Critical" or "Error" event logs only (Level 1 and 2)

mlevsh
Builder

Is there any way to monitor System Event Viewer logs ( [WinEventLog://System] ) for Event Level set to "Critical" and/or "Error" only (Level =1 or 2) ?

alt text

0 Karma

danielransell
Path Finder

It appears Splunk should allow you to whitelist based on Type, which is the field/key where the level is sent.

I would start with:
whitelist = Type="^[1|2]"

references:
http://docs.splunk.com/Documentation/Splunk/7.1.1/Data/MonitorWindowseventlogdata#Create_advanced_fi...
https://msdn.microsoft.com/en-us/library/aa394226(v=vs.85).aspx

mlevsh
Builder

@danielransell , confirmed. I was able to test it yesterday: used "whitelist = Type = "Error" " in our test environment

0 Karma

danielransell
Path Finder

I think you want to look at whitelisting for this. I have blacklisted certain event codes when ingesting security logs - I believe you can also perform whitelisting, that is on ingest events that meet a particular criteria.

0 Karma

mlevsh
Builder

@danielransell we whitelist Event Codes , for example. But cannot find any mentioning on how to whitelist Levels (Critical, Error)

0 Karma

jconger
Splunk Employee
Splunk Employee

To whitelist levels, you would need to create a whitelist regex. you should be able to mix event IDs and regex with separate lines like so:

whitelist1 = <list of eventIDs>
whitelist2 = key=regex [key=regex]
0 Karma

mlevsh
Builder

@ jconger , it's not clear to me what you mean. can you , please, give more details or examples?
We are trying to get errors no matter what event ID is.

0 Karma
Get Updates on the Splunk Community!

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...