How to filter out a Windows Event Code if the event from a user repeats over a period of time?

[hartfoml]

I want to capture Windows Event Logs EventCode 4673 when it happens once for each user over a period of one hour. If a single user generates this Event Code 100 times in one hour I would like to record it only once in Splunk.

If this is not doable, can I remove the payload suppress_text = 1 for this event only and not for all Windows Security Events?

[woodcock]

Assuming that you have a field called user, you can do it at search-time with:

... | dedup EventCode user ...

However I do not know of any way to do it at index-time. Also, you cannot selectively suppress_text; it applies to the entire stanza (which can selectively apply to EventCodes by using whitelist and blacklist). Also you can only use a specific WinEventLog stanza header once; if you duplicate any, only the last one in the file will be used (all others ignored). If you really need to re-use a stanza header, you will have to stand up multiple Splunk instances on your forwarder so each has a different configuration.

[hartfoml]

Hi @woodcock, Thanks for your suggestion and comment. The requierment is to reduce index on this event without eliminating it. I think I can add more than one blacklist item for the WinEventLog stanza so If i wanted to blacklist with regex or "EventCode=" I could just use blacklist1= blacklist2= etc. This would alow me to filter out all events for the EventCode at index time. I waas hopeing to get some but filter out most.

Thanks again for your help.

[woodcock]

No; blacklist is all-or-none.

[maciep]

I can't think of any way to inherently accomplish that. Typically that kind of logic would get applied at search time. But if that's not an option for you, then maybe just blacklist that event id (see blog post below). And then you could probably script something to accomplish your goal for that event id.

Event Logs in Splunk 6

[hartfoml]

@maciep thanks for the link to the blog. I read it and it was very helpful in understanding how to set up the UF for filtering out events before index.

Unfortunately this will not meet the requirement. I will look into scripting something to do the filtering.

Thanks much for the suggestion.