Splunk Enterprise

Windows XML Filtering with $XmlRegex doesn't work on every machine

CallumP
Engager

I have two separate deployment apps going to separate classes. One we'll call A is working great with full event filtering and blacklisting via $XmlRegex in inputs.conf see below:

 

whitelist1 = $XmlRegex="<EventID>(1|12|13|6|1100|4624|4625|4634|4648|4663|4672|4688|4719|4722|4724|4732|4733|4735|4737|4739|4778|4779|4946|5140)<\/EventID>"
blacklist1 = $XmlRegex="<EventID>4688<\/EventID>.*<Data Name='NewProcessName'>[C-F]:\\Program Files\\Splunk(?:UniversalForwarder)?\\bin\\(?:btool|splunkd|splunk|splunk-(?:MonitorNoHandle|admon|netmon|perfmon|powershell|regmon|winevtlog|winhostinfo|winprintmon|wmi))\.exe"

 

This is under the WinEventLog stanza. I've now copied this over to class B with more hosts but this whitelist / blacklist isn't working. Our license is getting hit hard by the 4688 events and so need to trim them down considerably.

I've read other similar questions but we're using Xml Windows logs so classic responses don't work, I have also tried outright blocking it with props and transforms on our intermediate heavy forwarder with no success there either so either inputs or props and transforms help would be great

Labels (2)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

Hi @CallumP,

Splunk_TA_windows app already has blacklist1 and blacklist2. Please try with blacklist3 lie below. 

The difference between serverclasses maybe Splunk_TA_windows app existence.

whitelist3 = $XmlRegex="<EventID>(1|12|13|6|1100|4624|4625|4634|4648|4663|4672|4688|4719|4722|4724|4732|4733|4735|4737|4739|4778|4779|4946|5140)<\/EventID>"
blacklist3 = $XmlRegex="<EventID>4688<\/EventID>.*<Data Name='NewProcessName'>[C-F]:\\Program Files\\Splunk(?:UniversalForwarder)?\\bin\\(?:btool|splunkd|splunk|splunk-(?:MonitorNoHandle|admon|netmon|perfmon|powershell|regmon|winevtlog|winhostinfo|winprintmon|wmi))\.exe"
If this reply helps you an upvote is appreciated.

View solution in original post

0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @CallumP,

Splunk_TA_windows app already has blacklist1 and blacklist2. Please try with blacklist3 lie below. 

The difference between serverclasses maybe Splunk_TA_windows app existence.

whitelist3 = $XmlRegex="<EventID>(1|12|13|6|1100|4624|4625|4634|4648|4663|4672|4688|4719|4722|4724|4732|4733|4735|4737|4739|4778|4779|4946|5140)<\/EventID>"
blacklist3 = $XmlRegex="<EventID>4688<\/EventID>.*<Data Name='NewProcessName'>[C-F]:\\Program Files\\Splunk(?:UniversalForwarder)?\\bin\\(?:btool|splunkd|splunk|splunk-(?:MonitorNoHandle|admon|netmon|perfmon|powershell|regmon|winevtlog|winhostinfo|winprintmon|wmi))\.exe"
If this reply helps you an upvote is appreciated.
0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>