About benbabich

benbabich · ‎01-16-2020

This worked great for me. After I Americanized the date format.

benbabich · ‎05-14-2018

Once Regex enters the fray under [WinEventLog://System], the other system (commas) is thrown out the window. "You have to use exclusively just event code (like whitelist1), or key/value regexes (like whitelist2). You can't mix and match in the same input stanza". Got that info from PeanutButterW0lf over on reddit.com/r/splunk, so props to him. This works: [WinEventLog://System] disabled = 0 whitelist = EventCode="104|1074|2020|6008|6009|12295|29223|40960|40961" whitelist1 = Type=/Error|Warning/

benbabich · ‎05-07-2018

I only want Error and Warning events from Windows System logs, except for a couple of individual events (104 and 1074) which I want event though they're 'information' events. [WinEventLog://System] disabled = 0 whitelist1 = 104,1074 whitelist2 = Type=/Error|Warning/ If I have just whitelist 1, I get the 1074 events (which are informational) but when I add whitelist 2, I only get Error and Warning events but no longer get 1074 events. How to I get both?

benbabich · ‎02-06-2018

I turned on auditing for .exe's so I can see psexec usage on servers. So I'm looking for some 4688 events (in windows security logs).I block most but I want to see the following: whitelist2 = EventCode="4688" Message="(?:New Process Name:).+(?:cmd.exe)" whitelist3 = EventCode="4688" Message="(?:New Process Name:).+(?:cscript.exe)" whitelist4 = EventCode="4688" Message="(?:New Process Name:).+(?:wscript.exe)" whitelist5 = EventCode="4688" Message="(?:New Process Name:).+(?:PsExec.exe)" whitelist6 = EventCode="4688" Message="(?:Process Command Line:).+(?:cscript.exe?)" It works on my servers but my Splunk indexer server now reports EVERY 4688 event (any .exe that is opened which is 100+ a minute) and I've added blacklist1 = EventCode="4688" to every inputs.conf file I can find on the server (including $SPLUNK_HOME/etc/system/local) and I can't get it to stop reporting 4688 events. I could just use host!=[servername] in a search head to not see those results but I'd rather just find a way to stop it entirely.

benbabich · ‎02-06-2018

Its not a cluster. And I do not use a separate deployment server, I use the same server for that.

benbabich · ‎02-02-2018

I want to blacklist some events that the Splunk server is sending to itself but my indexer isn't even running the SplunkForwarder Service and the inputs.conf file that I'd edit on my other servers doesn't effect what it's sending to itself. Does it use an inputs.conf file in a different location? Also, since it's not running the SplunkForwarder Service, what do I restart (if anything) after I edit the correct inputs.conf? Do I have to restart the Splunkd Service (ie: splunk itself)?

benbabich · ‎11-20-2017

I want to blacklist 4698, 4699, 4700, 4701,4702 if they contain 'Microsoft\Windows' in the Task Name. Would either of these work? blacklist1 = EventCode="4698,4699,4700,4701,4702" Message="(?:Task Name:).+(?:Microsoft\Windows?)" or blacklist1 = EventCode="4698-4702" Message="(?:Task Name:).+(?:Microsoft\Windows?)" Or would I have to have a separate line for each, such as : blacklist1 = EventCode="4698" Message="(?:Task Name:).+(?:Microsoft\Windows?)" blacklist2 = EventCode="4699" Message="(?:Task Name:).+(?:Microsoft\Windows?)" etc

benbabich · ‎10-13-2017

I was really trying to do it in Blacklist due to some convoluted but prebuilt blacklists I inherited but I think I'll just have to build it out properly in the whitelist. It really is the best way to do it.

benbabich · ‎10-13-2017

I really wanted that to work. But where ".\$" in Regex still gives me names not ending in $, | where Account_Name="$" | gives me zero results. I'll play around with it and see though.

benbabich · ‎10-13-2017

That does work but I have some inherited blacklists that would have made it easier (for other reasons not shown in the example) to do it in blacklist.

benbabich · ‎10-12-2017

I only want to see cmd.exe and blacklist everything else for EventCode 4688. blacklist = EventCode="4688" Message="(?:New Process Name:).+(?:cmd.exe)" will remove cmd.exe but 'Message!=' doesn't do the opposite.

benbabich · ‎10-12-2017

I want to find all names in Account_Name that end with a $ and not ones that don't. IE: I want NAME1$ but not NAME2. I've been trying regex Account_Name=".*\$" but am still getting NAME2. Any ideas?

Posts	12
Solutions	1
Karma Given	3
Karma Received	1
Member Since	‎07-18-2017

Online Status	Offline
Date Last Visited	‎12-22-2022 01:35 AM

Whitelist stacking issues in inputs.conf

How does the indexer forward data to itself?

How do I blacklist multiple events on same line: C...

Can I use != in blacklist?

Regex to find Account_Name's that end in a $ and \...

Re: Finding the 1st logon and logoff event times f...

Re: Whitelist stacking issues in inputs.conf

Whitelist stacking issues in inputs.conf

Re: How does the indexer forward data to itself?

Re: How does the indexer forward data to itself?

How does the indexer forward data to itself?

How do I blacklist multiple events on same line: C...

Re: Can I use != in blacklist?

Re: Regex to find Account_Name's that end in a $ a...

Re: Can I use != in blacklist?

Can I use != in blacklist?

Regex to find Account_Name's that end in a $ and \...

Are you a member of the Splunk Community?