We are attempting to ingest server powershell logging into Splunk. We found that ingest all the data was noisy and want to reduce the data ingested to what we really care about. Our goal is to only ingest Event Code 4104 with the level: Warning.
Is there a way to blacklist everything, and then whitelist only Event Code 4104 with the level: Warning?
We are ingesting via here: [WinEventLog://Microsoft-Windows-PowerShell/Operational]
inputs.conf - http://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf
Look at the Windows Event Log Monitor Section
Example from inputs.conf documentation:
whitelist = EventCode=%^200$% User=%jrodman%
Include events only if they have EventCode 200 and relate to User jrodman
Follow this pattern for your EventCode and Second Field you want to match