Getting Data In

inputs.conf Windows event whitelist

isolsplunk
New Member

Hi guys,
it seems there's something wrong with my inputs.conf whitelist configuration :

[WinEventLog://System]
index = winsecevents
disabled = 0
start_from = oldest
current_only = 0
checkpointInterval = 5
renderXml = true
whitelist = EventCode="^104$" TaskCategory="^Log\sclear"

I tried of course with :
whitelist = EventCode="104" TaskCategory="Log clear"
or with the "message" conf like this one :

whitelist = EventCode="104" Message=".+log\sfile\swas\scleared."

But nothing has changed.
Do you have some ideas?
Thanks a lot.

0 Karma

isolsplunk
New Member

Ok,I understood why it doesn't works.
I have renderXml=true and if I check the windows event,there's not any field i was looking for.
I must change the logic,parsing the raw xml and looking through it.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi
from https://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf

whitelist = <regular expression>
* If set, files from this input are monitored only if their path matches the
  specified regex.
* Takes precedence over the deprecated '_whitelist' setting, which functions
  the same way.
* Default: Not set.

So check the regex with your logs escaping all special chars (as = or ") , it should be something like this:

whitelist = EventCode\=104.*TaskCategory\=Log\sclear

Ciao.
Giuseppe

0 Karma

isolsplunk
New Member

Ciao Giuseppe,
thanks for your comment.
I think i'm missing something...just to be clear,I'm trying to filter windows event logs and not custom.
In another stanza I have these settings that are running correctly :

[WinEventLog://Security]
index = winsecevents
disabled = 0
start_from = oldest
current_only = 0
evt_resolve_ad_obj = 1
checkpointInterval = 5
blacklist1 = EventCode="4662|566" Message="Object Type:(?!\s*groupPolicyContainer)"
blacklist2 = EventCode="4634|4624" Message="Logon Type:\s+3"
blacklist3 = EventCode="4648|4658" Message="Process Name:\s+C:\Program\sFiles\Microsoft\sAzure\sAD\sSync\Bin\miiserver.exe"
renderXml=true

The difference is just the keyword "blacklist" instead of "whitelist" but this one :
whitelist = EventCode="104" TaskCategory=".*Log\sclear"
or this :
whitelist = EventCode="104" Message=".+\slog\sfile\swas\scleared."

looks totally correct to me.
Thanks.

0 Karma

sandeepmakkena
Contributor
whitelist = EventCode=%^104$%

Try this edit and restart the Splunk, I hope this will help!

0 Karma

sandeepmakkena
Contributor

props.conf

  [WinEventLog://System]
  TRANSFORMS-FilterEvent = FilterEvent

transforms.conf

 [FilterEvent]
 REGEX = EventCode="^104$" 
 DEST_KEY = queue
 FORMAT = nullQueue

Try this as well!

0 Karma

isolsplunk
New Member

Hi there,the issue is related to the second part of the filter : taskcategory/message (they are on the same line but the post has been modified.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...