Dear All ,
i am using below inputs.conf to white list few windows event logs that i only need for my syslog . Rest i want to drop but some how its not working fine for me ..Request help on this from you..
[WinEventLog://Security]
disabled = 0
start_from = oldest
current_only = 0
evt_resolve_ad_obj = 1
checkpointInterval = 5
whitelist = 624,627,629,630,1100,1102,1104,4616,4618,4698,4720,4723,4724,4725,4726,4733,4734,4735,4739,4740
index = wineventlog
renderXml=false
http://blogs.splunk.com/2013/10/14/windows-event-logs-in-splunk-6/
http://answers.splunk.com/answers/152131/filter-windows-eventcode-using-blacklist-and-whitelist.html
... View more