Getting Data In

Can I filter on MV field with 6.0+ UF?

glancaster
Path Finder

Hello all!

In regards to the Windows Event Log filtering in the newer 6.0+ forwarders. I'm looking for some help on filtering out events what aren't required for us to keep and are really eating into our license usage. The event code is 4624 and I want to remove events where the second Secrurity_ID filed contains a "$" at the end.

I've tried the following with no luck and am wondering if this is even possible:

blacklist3 = EventCode=4624 Security_ID="NULL SID" Security_ID="DOMAIN*$"

From what I understand in the docs, for the event to be filtered out it needs to match all conditions of the blacklist. Based on my testing I am fairly certain this isn't the way to identify the second value of a field. Can anyone point me in the right direction to get this to work?

Thanks in advance!

0 Karma

woodcock
Esteemed Legend

Do you have a blacklist1 and blacklist2, too? I don't think blacklist3 will work without them. If you don't, then try this (escaping the dollar sign, too):

blacklist1 = EventCode=4624 Security_ID="NULL SID" Security_ID="DOMAIN*\$"
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...