Which of the following actions enables you to view the event viewer of a remote computer?

Windows generates log data during the course of its operations. The Windows Event Log service handles nearly all of this communication. It gathers log data that installed applications, services, and system processes publish and places the log data into event log channels. Programs such as Microsoft Event Viewer subscribe to these log channels to display events that have occurred on the system.

You can monitor event log channels and files that are on the local machine or you can collect logs from remote machines. The event log monitor runs once for every event log input that you define.

To monitor Windows Event Log channels in Splunk Cloud Platform, use a Splunk universal or heavy forwarder to collect the data and forward it to your Splunk Cloud Platform deployment. As a best practice, use the Splunk Add-on for Windows to simplify the process of getting data into Splunk Cloud Platform. For instructions on using the Splunk Add-on for Windows to get data into Splunk Cloud Platform, see Get Windows Data Into Splunk Cloud in the Splunk Cloud Admin Manual.

Why monitor event logs?

Windows event logs are the core metric of Windows machine operations. If there is a problem with your Windows system, the Event Log service has logged it. The Splunk platform indexing, searching, and reporting capabilities make your logs accessible.

Requirements for monitoring event logs

ActivityRequirementsMonitor local event logs

• The Splunk universal forwarder or Splunk Enterprise instance must run on Windows. See Install on Windows in the Installation Manual.
• The Splunk universal forwarder or Splunk Enterprise instance must run as the Local System Windows user to read all local event logs.

Monitor remote event logs

• The universal forwarder or heavy forwarder must run on the Windows machine from which you want to collect event logs.
• The Splunk universal forwarder or heavy forwarder must run as a domain or remote user with read access to Windows Management Instrumentation (WMI) on the remote machine. See Choose the Windows user Splunk Enterprise should run as in the Installation Manual.
• The user that the forwarder runs as must have read access to the event logs you want to collect.

Security and other considerations for collecting event log data from remote machines

You collect event log data from remote machines using a universal forwarder, a heavy forwarder, or WMI. As a best practice, use a universal forwarder to send event log data from remote machines to an indexer. See The universal forwarder in the Universal Forwarder manual for information about how to install, configure and use the forwarder to collect event log data. If you can't install a forwarder on the machine where you want to get data, you can use a WMI.

To install forwarders on your remote machines to collect event log data, install the forwarder as the Local System user on these machines. The Local System user has access to all data on the local machine, but not on remote machines.

To use WMI to get event log data from remote machines, you must ensure that your network and Splunk Enterprise instances are properly configured. Do not install Splunk software as the Local System user. The user you use to install the software determines the event logs that Splunk software has access to. See for additional information on the requirements you must satisfy to collect remote data properly using WMI.

By default, Windows restricts access to some event logs depending on the version of Windows you run. For example, only members of the local Administrators or global Domain Admins groups can read the Security event logs by default.

How the Windows Event Log monitor interacts with Active Directory

When you set up an Event Log monitoring input for WMI, the input connects to an Active Directory (AD) domain controller to authenticate and, if necessary, performs any security ID (SID) translations before it begins to monitor the data.

The Event Log monitor uses the following logic to interact with AD after you set it up:

1. If you specify a domain controller when you define the input with the # Windows platform specific input processor. [WinEventLog://Application] disabled = 0 [WinEventLog://Security] disabled = 0 [WinEventLog://System] disabled = 0 6 setting in the inputs.conf file, then the input uses that domain controller for AD operations.
2. If you do not specify a domain controller, then the input does the following:
   1. The input attempts to use the local system cache to authenticate or resolve SIDs.
   2. If the monitor cannot authenticate or resolve SIDs that way, it attempts a connection to the domain controller that the machine that runs the input used to log in.
   3. If that does not work, then the input attempts to use the closest AD domain controller that has a copy of the Global Catalog.
3. If the domain controller that you specify is not valid, or a domain controller cannot be found, then the input generates an error message.

Collect event logs from a remote Windows machine

You have two choices to collect data from a remote Windows machine:

• Use a universal forwarder
• Use WMI

Use a universal or heavy forwarder

You can install a universal forwarder or a heavy forwarder on the Windows machine and instruct it to collect event logs. You can do this manually or use a deployment server to manage the forwarder configuration.

1. On the Windows machine for which you want to collect Windows Event Logs, download Splunk Enterprise or the universal forwarder software.
2. Run the universal forwarder installation package to begin the installation process.
3. When the installer prompts you, configure a receiving indexer.
4. When the installer prompts you to specify inputs, enable the event log inputs by checking the Event logs checkbox.
5. Complete the installation procedure.
6. On the receiving indexer, use Splunk Web to search for the event log data as in the following example:

   # Windows platform specific input processor. [WinEventLog://Application] disabled = 0 [WinEventLog://Security] disabled = 0 [WinEventLog://System] disabled = 0 7

For specific instructions to install the universal forwarder, see Install a Windows universal forwarder in the Forwarder Manual.

Use WMI

If you want to collect event logs remotely using WMI, you must install the universal or heavy forwarder to run as an Active Directory domain user. If the selected domain user is not a member of the Administrators or Domain Admins groups, then you must configure event log security to give the domain user access to the event logs.

To change event log security to get access to the event logs from remote machines, you must meet the following requirements:

You can use the wevtutil utility to set event log security.

1. Download a Splunk Enterprise instance onto a Windows machine.
2. Double-click the installer file to begin the installation.
3. When the installer prompts you to specify a user, select Domain user.
4. On the next installer pane, enter the domain user name and password that you want Splunk Enterprise to use when it runs.
5. Follow the prompts to complete the installation of the software.
6. Once the software has installed, log in to the instance.
7. Use Splunk Web to add the remote event log input. See later in this topic.

Anomalous machine names are visible in event logs on some systems

On some Windows systems, you might see some event logs with randomly-generated machine names. This is the result of those systems logging events before the user has named the system during the OS installation process.

This anomaly occurs only when you collect logs from versions of Windows remotely over WMI.

Configure local event log monitoring with Splunk Web

To get local Windows event log data, point your Splunk Enterprise instance at the Event Log service.

Go to the Add Data page

You can get there in two ways:

• Splunk Settings
• Splunk Home

From Splunk Settings:

1. Click Settings > Data Inputs.
2. Click Local event log collection.
3. Click New to add an input.

From Splunk Home:

1. Click the Add Data link in Splunk Home.
2. Click Monitor to monitor Event Log data on the local Windows machine, or Forward to forward Event Log data from another Windows machine.
   Splunk Enterprise loads the Add Data - Select Source page.
3. If you selected Forward, select or create the group of forwarders you want this input to apply to. See Forward data in this manual.
4. Click Next.

Select the input source

1. Select Local Event Logs
2. In the Select Event Logs list, select the Event Log channels you want this input to monitor.
3. Click each Event Log channel you want to monitor once.
   Splunk Enterprise moves the channel from the Available items window to the Selected items window.
4. To deselect a channel, click its name in the Available Items window.
   Splunk Enterprise moves the channel from the Selected items window to the Available items window.
5. To select or deselect all of the event logs, click the add all or remove all links.

   Selecting all of the channels can result in the indexing of a lot of data.

6. Click Next.

Specify input settings

The Input Settings page lets you specify the application context, default host value, and index. All of these parameters are optional.

The Host field sets only the host field in the resulting events. It doesn't direct Splunk Enterprise to look on a specific machine on your network.

1. Select the appropriate Application context for this input.
2. Set the Host value. You have several choices for this setting. For more information about setting the host value, see About hosts.
3. Set the Index that you want Splunk Enterprise to send data to. Leave the value as default, unless you defined multiple indexes to handle different types of events. In addition to indexes for user data, Splunk Enterprise has a number of utility indexes, which also appear in this dropdown box.
4. Click Review.

Review your choices

After you specify all your input settings, you can review your selections. Splunk Enterprise lists all options you selected, including the type of monitor, the source, the source type, the application context, and the index.

1. Review the settings.
2. If they do not match what you want, click the left angle bracket ( < ) to go back to the previous step in the wizard. Otherwise, click Submit.

Splunk Enterprise then displays the "Success" page and begins indexing the specified Event Log channels.

Configure remote event log monitoring with Splunk Web

The process for configuring remote event log monitoring is nearly identical to the process for monitoring local event logs.

1. Follow the instructions to get to the Add Data page. See .
2. Locate and select Remote Event Logs.
3. In the Event Log collection name field, enter a unique, memorable name for this input.
4. In the Choose logs from this host field, enter the host name or IP address of the machine that contains the Event Log channels you want to monitor.

   Selecting all of the Event Log channels can result in the indexing of a lot of data.

5. Click the Find logs button to refresh the page with a list of available Event Log channels on the machine you entered.
6. Click once on each Event Log channel you want to monitor.
   Splunk Enterprise moves the channel from the Available items window to the Selected items window.
7. To deselect a channel, click its name in the Available Items window.
   Splunk Enterprise moves the channel from the Selected items window to the Available items window.
8. To select or deselect all of the event logs, click the add all or remove all links.
9. In the Collect the same set of logs from additional hosts field, enter the host names or IP addresses of additional machines that contain the Event Logs you selected previously. Separate multiple machines with commas.
10. Click the green Next button.
11. Follow the instructions to specify input settings. See .
12. Follow the instructions to review your choices. See .

Use the inputs.conf configuration file to configure event log monitoring

On either a universal or heavy forwarder, you can edit the inputs.conf configuration file to configure Windows event log monitoring.

1. Using Notepad or a similar editor, open %SPLUNK_HOME%\etc\system\local\inputs.conf for editing. You might need to create this file if it doesn't exist.
2. Enable Windows event log inputs by adding input stanzas that reference Event Log channels.
3. Save the file and close it.
4. Restart the Splunk platform.

For more information on configuring data inputs with the inputs.conf file, see .

Specify global settings for Windows Event Log inputs

When you define Windows Event Log inputs in inputs.conf, make sure you explicitly specify global settings in the correct place.

If you specify global settings for Windows Event Log inputs, such as # Windows platform specific input processor. [WinEventLog://Application] disabled = 0 [WinEventLog://Security] disabled = 0 [WinEventLog://System] disabled = 0 8, # Windows platform specific input processor. [WinEventLog://Application] disabled = 0 [WinEventLog://Security] disabled = 0 [WinEventLog://System] disabled = 0 9, and so on, you can place those settings in one of the following areas:

• Under the [WinEventLog://DNS Server] disabled = 0 [WinEventLog://Directory Service] disabled = 0 [WinEventLog://File Replication Service] disabled = 0 0 global stanza. This stanza is equal to the [WinEventLog://DNS Server] disabled = 0 [WinEventLog://Directory Service] disabled = 0 [WinEventLog://File Replication Service] disabled = 0 1 stanza for other monitoring inputs. For example:

  [default] _meta = hf_proxy::meta_test [WinEventLog] _meta = hf_proxy::meta_test host = WIN2K16_DC index = wineventlog [WinEventLog://Application] disabled = 0

• Under the Windows Event Log input stanza for the Event Log channel that you want to monitor. For example:

  [default] _meta = hf_proxy::meta_test [WinEventLog] host = WIN2K16_DC index = wineventlog [WinEventLog://Application] disabled = 0 _meta = hf_proxy::meta_test

You can review the defaults for a configuration file by looking at the examples in %SPLUNK_HOME%\etc\system\default or at the spec file in the Admin Manual.

Event log monitor configuration values

Windows event log (*.evt) files are in binary format. You can't monitor them like you do a normal text file. The [WinEventLog://DNS Server] disabled = 0 [WinEventLog://Directory Service] disabled = 0 [WinEventLog://File Replication Service] disabled = 0 2 service monitors these binary files by using the appropriate APIs to read and index the data within the files.

Splunk Enterprise uses the following stanzas in inputs.conf to monitor the default Windows event logs:

# Windows platform specific input processor. [WinEventLog://Application] disabled = 0 [WinEventLog://Security] disabled = 0 [WinEventLog://System] disabled = 0

Monitor non-default Windows event logs

You can also configure Splunk Enterprise to monitor non-default Windows event logs. Before you can do this, you must import them to the Windows Event Viewer. After you import the logs, you can add them to your local copy of inputs.conf, as in the following example:

[WinEventLog://DNS Server] disabled = 0 [WinEventLog://Directory Service] disabled = 0 [WinEventLog://File Replication Service] disabled = 0

Use the Full Name log property in Event Viewer to specify complex Event Log channel names properly

You can use the [WinEventLog://DNS Server] disabled = 0 [WinEventLog://Directory Service] disabled = 0 [WinEventLog://File Replication Service] disabled = 0 3 Event Log property in Event Viewer to ensure that you specify the correct Event Log channel in an inputs.conf stanza.

For example, to monitor the Task Scheduler application log, [WinEventLog://DNS Server] disabled = 0 [WinEventLog://Directory Service] disabled = 0 [WinEventLog://File Replication Service] disabled = 0 4, do the following steps:

1. Open Event Viewer.
2. Expand Applications and Services Logs > Microsoft > Windows > TaskScheduler.
3. Right-click Operational and select Properties.
4. In the dialog that appears, copy the text in the Full Name field.
5. Append this text into the [WinEventLog://DNS Server] disabled = 0 [WinEventLog://Directory Service] disabled = 0 [WinEventLog://File Replication Service] disabled = 0 5 stanza of inputs.conf as in the following example:

   [WinEventLog://Microsoft-Windows-TaskScheduler/Operational] disabled = 0

Disable an event log stanza

To disable indexing for an event log, add [WinEventLog://DNS Server] disabled = 0 [WinEventLog://Directory Service] disabled = 0 [WinEventLog://File Replication Service] disabled = 0 6 after its listing in the stanza in %SPLUNK_HOME%\etc\system\local\inputs.conf.

Configuration settings for monitoring Windows Event Logs

Splunk software uses the following settings in inputs.conf to monitor Event Log files:

AttributeDescriptionDefault[WinEventLog://DNS Server] disabled = 0 [WinEventLog://Directory Service] disabled = 0 [WinEventLog://File Replication Service] disabled = 0 7

How to read events.

Acceptable values are [WinEventLog://DNS Server] disabled = 0 [WinEventLog://Directory Service] disabled = 0 [WinEventLog://File Replication Service] disabled = 0 8, meaning read logs from the oldest to the newest, and [WinEventLog://DNS Server] disabled = 0 [WinEventLog://Directory Service] disabled = 0 [WinEventLog://File Replication Service] disabled = 0 9, meaning read logs from the newest to the oldest.

You can't set this attribute to [WinEventLog://DNS Server] disabled = 0 [WinEventLog://Directory Service] disabled = 0 [WinEventLog://File Replication Service] disabled = 0 9 while also setting the [WinEventLog://Microsoft-Windows-TaskScheduler/Operational] disabled = 0 1 attribute to [WinEventLog://Microsoft-Windows-TaskScheduler/Operational] disabled = 0 2.

[WinEventLog://DNS Server] disabled = 0 [WinEventLog://Directory Service] disabled = 0 [WinEventLog://File Replication Service] disabled = 0 8[WinEventLog://Microsoft-Windows-TaskScheduler/Operational] disabled = 0 1

How to index events.

Acceptable values are [WinEventLog://Microsoft-Windows-TaskScheduler/Operational] disabled = 0 2, where the input acquires events that arrive after the input starts for the first time, like [WinEventLog://Microsoft-Windows-TaskScheduler/Operational] disabled = 0 6 on *nix systems, or [WinEventLog://Microsoft-Windows-TaskScheduler/Operational] disabled = 0 7, where the input gets all existing events in the log and then continues to monitor incoming events in real time.

You can't set this attribute to [WinEventLog://DNS Server] disabled = 0 [WinEventLog://Directory Service] disabled = 0 [WinEventLog://File Replication Service] disabled = 0 9 while also setting the [WinEventLog://Microsoft-Windows-TaskScheduler/Operational] disabled = 0 1 attribute to [WinEventLog://Microsoft-Windows-TaskScheduler/Operational] disabled = 0 2.

0[WinEventLog://Security] disabled = 0 start_from = oldest current_only = 0 evt_resolve_ad_obj = 1 checkpointInterval = 5 # only index events with these event IDs. whitelist = 0-2000,3001-10000 # exclude these event IDs from being indexed. blacklist = 2001-3000 1

How frequently, in seconds, the Windows Event Log input saves a checkpoint.

Checkpoints store the eventID of acquired events to enable Splunk software to resume monitoring at the correct event after a shutdown or outage.

0[WinEventLog://Security] disabled = 0 start_from = oldest current_only = 0 evt_resolve_ad_obj = 1 checkpointInterval = 5 # only index events with these event IDs. whitelist = 0-2000,3001-10000 # exclude these event IDs from being indexed. blacklist = 2001-3000 2

The domain controller Splunk software uses to interact with Active Directory while indexing Windows Event Log channels. Valid only when you set the [WinEventLog://Security] disabled = 0 start_from = oldest current_only = 0 evt_resolve_ad_obj = 1 checkpointInterval = 5 # only index events with these event IDs. whitelist = 0-2000,3001-10000 # exclude these event IDs from being indexed. blacklist = 2001-3000 3 attribute to [WinEventLog://Microsoft-Windows-TaskScheduler/Operational] disabled = 0 2 and omit the # Windows platform specific input processor. [WinEventLog://Application] disabled = 0 [WinEventLog://Security] disabled = 0 [WinEventLog://System] disabled = 0 6 attribute.

Valid values are [WinEventLog://Security] disabled = 0 start_from = oldest current_only = 0 evt_resolve_ad_obj = 1 checkpointInterval = 5 # only index events with these event IDs. whitelist = 0-2000,3001-10000 # exclude these event IDs from being indexed. blacklist = 2001-3000 6, meaning to use the nearest domain controller to bind to for AD object resolution, or [WinEventLog://Security] disabled = 0 start_from = oldest current_only = 0 evt_resolve_ad_obj = 1 checkpointInterval = 5 # only index events with these event IDs. whitelist = 0-2000,3001-10000 # exclude these event IDs from being indexed. blacklist = 2001-3000 7, meaning to bind to the primary domain controller for the AD site that the host is in. If you also set the # Windows platform specific input processor. [WinEventLog://Application] disabled = 0 [WinEventLog://Security] disabled = 0 [WinEventLog://System] disabled = 0 6 attribute, Splunk software ignores this attribute.

[WinEventLog://Security] disabled = 0 start_from = oldest current_only = 0 evt_resolve_ad_obj = 1 checkpointInterval = 5 # only index events with these event IDs. whitelist = 0-2000,3001-10000 # exclude these event IDs from being indexed. blacklist = 2001-3000 6[WinEventLog://Security] disabled = 0 start_from = oldest current_only = 0 evt_resolve_ad_obj = 1 checkpointInterval = 5 # only index events with these event IDs. whitelist = 0-2000,3001-10000 # exclude these event IDs from being indexed. blacklist = 2001-3000 3

How Splunk software interacts with Active Directory while indexing Windows Event Log channels. Valid values are [WinEventLog://Microsoft-Windows-TaskScheduler/Operational] disabled = 0 2, meaning resolve Active Directory objects like Globally Unique IDentifier (GUID) and Security IDentifier (SID) objects to their canonical names for a specific Windows event log channel, and [WinEventLog://Microsoft-Windows-TaskScheduler/Operational] disabled = 0 7, meaning not to attempt any resolution.

When you set this value to [WinEventLog://Microsoft-Windows-TaskScheduler/Operational] disabled = 0 2, you can optionally specify the Domain Controller name or DNS name of the domain to bind to, which Splunk software uses to resolve the AD objects. If you don't set this value, or if you set it to 0, Splunk software does not attempt to resolve the AD objects.

0# Windows platform specific input processor. [WinEventLog://Application] disabled = 0 [WinEventLog://Security] disabled = 0 [WinEventLog://System] disabled = 0 6

Which Active Directory domain controller to bind to resolve AD objects. This name can be the NetBIOS name of the domain controller, the fully-qualified DNS name of the domain controller, or an environment variable name specified as [WinEventLog://Security] disabled = 0 start_from = oldest current_only = 0 evt_resolve_ad_obj = 1 checkpointInterval = 5 # suppress message text, we only want the event number. suppress_text = 1 # only index events with these event IDs. whitelist = 0-2000,2001-10000 # exclude these event IDs from being indexed. blacklist = 2001-3000 5.

If you set this attribute, then Splunk software ignores the [WinEventLog://Security] disabled = 0 start_from = oldest current_only = 0 evt_resolve_ad_obj = 1 checkpointInterval = 5 # only index events with these event IDs. whitelist = 0-2000,3001-10000 # exclude these event IDs from being indexed. blacklist = 2001-3000 2 attribute, which controls how the software determines the best domain controller to bind to for AD object resolution.

If you specify an environment variable, you must prepend a dollar sign ([WinEventLog://Security] disabled = 0 start_from = oldest current_only = 0 evt_resolve_ad_obj = 1 checkpointInterval = 5 # suppress message text, we only want the event number. suppress_text = 1 # only index events with these event IDs. whitelist = 0-2000,2001-10000 # exclude these event IDs from being indexed. blacklist = 2001-3000 7) to the environment variable name. Splunk software uses the specified environment variable as the domain controller to connect to for AD object resolution. For example, to use the [WinEventLog://Security] disabled = 0 start_from = oldest current_only = 0 evt_resolve_ad_obj = 1 checkpointInterval = 5 # suppress message text, we only want the event number. suppress_text = 1 # only index events with these event IDs. whitelist = 0-2000,2001-10000 # exclude these event IDs from being indexed. blacklist = 2001-3000 8 variable, specify [WinEventLog://Security] disabled = 0 start_from = oldest current_only = 0 evt_resolve_ad_obj = 1 checkpointInterval = 5 # suppress message text, we only want the event number. suppress_text = 1 # only index events with these event IDs. whitelist = 0-2000,2001-10000 # exclude these event IDs from being indexed. blacklist = 2001-3000 9.

You can precede either format with two backslash characters. This attribute does not have a default.

N/A[WinEventLog://Security] disabled = 0 start_from = oldest current_only = 0 evt_resolve_ad_obj = 1 evt_dc_name = boston-dc1.contoso.com checkpointInterval = 5 # suppress message text, we only want the event number. suppress_text = 1 # only index events with these event IDs. whitelist = 0-2000,2001-10000 # exclude these event IDs from being indexed. blacklist = 2001-3000 0The fully-qualified DNS name of the domain to bind to resolve AD objects.N/A[WinEventLog://Security] disabled = 0 start_from = oldest current_only = 0 evt_resolve_ad_obj = 1 evt_dc_name = boston-dc1.contoso.com checkpointInterval = 5 # suppress message text, we only want the event number. suppress_text = 1 # only index events with these event IDs. whitelist = 0-2000,2001-10000 # exclude these event IDs from being indexed. blacklist = 2001-3000 1A list of Windows Event Log fields that the Windows Event Log input is to exclude when it ingests Windows Event Log data. When you specify this setting, the input removes both the key and value data for the fields you exclude. This setting works similar to the [WinEventLog://Security] disabled = 0 start_from = oldest current_only = 0 evt_resolve_ad_obj = 1 evt_dc_name = boston-dc1.contoso.com checkpointInterval = 5 # suppress message text, we only want the event number. suppress_text = 1 # only index events with these event IDs. whitelist = 0-2000,2001-10000 # exclude these event IDs from being indexed. blacklist = 2001-3000 2 settings, but unlike those settings, this setting is valid for all Windows Event Log fields, and excludes fields that you might have included in an allow list. When this collision happens, the instance logs an error. See "Create advanced filters with 'whitelist' and 'blacklist'" later in this topic for the list of Windows Event Log fields that you can exclude.N/A[WinEventLog://Security] disabled = 0 start_from = oldest current_only = 0 evt_resolve_ad_obj = 1 evt_dc_name = boston-dc1.contoso.com checkpointInterval = 5 # suppress message text, we only want the event number. suppress_text = 1 # only index events with these event IDs. whitelist = 0-2000,2001-10000 # exclude these event IDs from being indexed. blacklist = 2001-3000 3Whether to include the message text that comes with a security event. A value of 1 suppresses the message text, and a value of 0 preserves the text.0[WinEventLog://Security] disabled = 0 start_from = oldest current_only = 0 evt_resolve_ad_obj = 1 evt_dc_name = boston-dc1.contoso.com checkpointInterval = 5 # suppress message text, we only want the event number. suppress_text = 1 # only index events with these event IDs. whitelist = 0-2000,2001-10000 # exclude these event IDs from being indexed. blacklist = 2001-3000 4

Whether or not to read Event Log events with the Event Logging API.

This is an advanced setting. Contact Splunk Support before you change it.

If set to true, the input uses the Event Logging API instead of the Windows Event Log API to read from the Event Log on Windows Server 2008, Windows Vista, and higher installations.

[WinEventLog://Security] disabled = 0 start_from = oldest current_only = 0 evt_resolve_ad_obj = 1 evt_dc_name = boston-dc1.contoso.com checkpointInterval = 5 # suppress message text, we only want the event number. suppress_text = 1 # only index events with these event IDs. whitelist = 0-2000,2001-10000 # exclude these event IDs from being indexed. blacklist = 2001-3000 5 (Use the API that is specific to the OS.)[WinEventLog://Security] disabled = 0 start_from = oldest current_only = 0 evt_resolve_ad_obj = 1 evt_dc_name = boston-dc1.contoso.com checkpointInterval = 5 # suppress message text, we only want the event number. suppress_text = 1 # only index events with these event IDs. whitelist = 0-2000,2001-10000 # exclude these event IDs from being indexed. blacklist = 2001-3000 6

Specifies the number of threads, in addition to the default writer thread, that can be created to filter events with the allow list/deny list regular expression.

This is an advanced setting. Contact Splunk Support before you change it.

The maximum number of threads is 15.

0[WinEventLog://Security] disabled = 0 start_from = oldest current_only = 0 evt_resolve_ad_obj = 1 evt_dc_name = boston-dc1.contoso.com checkpointInterval = 5 # suppress message text, we only want the event number. suppress_text = 1 # only index events with these event IDs. whitelist = 0-2000,2001-10000 # exclude these event IDs from being indexed. blacklist = 2001-3000 7The interval, in milliseconds, between attempts to re-read Event Log files when a read error occurs.

This is an advanced setting. Contact Splunk Support before you change it.

5000[WinEventLog://Security] disabled = 0 start_from = oldest current_only = 0 evt_resolve_ad_obj = 1 evt_dc_name = boston-dc1.contoso.com checkpointInterval = 5 # suppress message text, we only want the event number. suppress_text = 1 # only index events with these event IDs. whitelist = 0-2000,2001-10000 # exclude these event IDs from being indexed. blacklist = 2001-3000 8

Whether or not the Event Log strictly follows the [WinEventLog://Security] disabled = 0 start_from = oldest current_only = 0 evt_resolve_ad_obj = 1 checkpointInterval = 5 # only index events with these event IDs. whitelist = 0-2000,3001-10000 # exclude these event IDs from being indexed. blacklist = 2001-3000 1 setting when it saves a checkpoint.

This is an advanced setting. Contact Splunk Support before you change it.

By default, the Event Log input saves a checkpoint from between zero and [WinEventLog://Security] disabled = 0 start_from = oldest current_only = 0 evt_resolve_ad_obj = 1 checkpointInterval = 5 # only index events with these event IDs. whitelist = 0-2000,3001-10000 # exclude these event IDs from being indexed. blacklist = 2001-3000 1 seconds, depending on incoming event volume.

false[WinEventLog://Security] disabled = 0 start_from = oldest current_only = 0 evt_resolve_ad_obj = 1 evt_resolve_ad_ds = PDC checkpointInterval = 5 # suppress message text, we only want the event number. suppress_text = 1 # only index events with these event IDs. whitelist = 0-2000,2001-10000 # exclude these event IDs from being indexed. blacklist = 2001-3000 1

Whether or not to exclude the [WinEventLog://Security] disabled = 0 start_from = oldest current_only = 0 evt_resolve_ad_obj = 1 evt_resolve_ad_ds = PDC checkpointInterval = 5 # suppress message text, we only want the event number. suppress_text = 1 # only index events with these event IDs. whitelist = 0-2000,2001-10000 # exclude these event IDs from being indexed. blacklist = 2001-3000 2 field from events.

This is an advanced setting. Contact Splunk Support before you change it.

When set to true, the input excludes the [WinEventLog://Security] disabled = 0 start_from = oldest current_only = 0 evt_resolve_ad_obj = 1 evt_resolve_ad_ds = PDC checkpointInterval = 5 # suppress message text, we only want the event number. suppress_text = 1 # only index events with these event IDs. whitelist = 0-2000,2001-10000 # exclude these event IDs from being indexed. blacklist = 2001-3000 2 field from events and throughput performance (the number of events processed per second) improves.

false[WinEventLog://Security] disabled = 0 start_from = oldest current_only = 0 evt_resolve_ad_obj = 1 evt_resolve_ad_ds = PDC checkpointInterval = 5 # suppress message text, we only want the event number. suppress_text = 1 # only index events with these event IDs. whitelist = 0-2000,2001-10000 # exclude these event IDs from being indexed. blacklist = 2001-3000 4

Whether or not to exclude the [WinEventLog://Security] disabled = 0 start_from = oldest current_only = 0 evt_resolve_ad_obj = 1 evt_resolve_ad_ds = PDC checkpointInterval = 5 # suppress message text, we only want the event number. suppress_text = 1 # only index events with these event IDs. whitelist = 0-2000,2001-10000 # exclude these event IDs from being indexed. blacklist = 2001-3000 5 field from events.

This is an advanced setting. Contact Splunk Support before you change it.

When set to true, the input excludes the [WinEventLog://Security] disabled = 0 start_from = oldest current_only = 0 evt_resolve_ad_obj = 1 evt_resolve_ad_ds = PDC checkpointInterval = 5 # suppress message text, we only want the event number. suppress_text = 1 # only index events with these event IDs. whitelist = 0-2000,2001-10000 # exclude these event IDs from being indexed. blacklist = 2001-3000 5 field from events and throughput performance (the number of events processed per second) improves.

false[WinEventLog://Security] disabled = 0 start_from = oldest current_only = 0 evt_resolve_ad_obj = 1 evt_resolve_ad_ds = PDC checkpointInterval = 5 # suppress message text, we only want the event number. suppress_text = 1 # only index events with these event IDs. whitelist = 0-2000,2001-10000 # exclude these event IDs from being indexed. blacklist = 2001-3000 7

Whether or not to exclude the [WinEventLog://Security] disabled = 0 start_from = oldest current_only = 0 evt_resolve_ad_obj = 1 evt_resolve_ad_ds = PDC checkpointInterval = 5 # suppress message text, we only want the event number. suppress_text = 1 # only index events with these event IDs. whitelist = 0-2000,2001-10000 # exclude these event IDs from being indexed. blacklist = 2001-3000 8 field from events.

This is an advanced setting. Contact Splunk Support before you change it.

When set to true, the input excludes the [WinEventLog://Security] disabled = 0 start_from = oldest current_only = 0 evt_resolve_ad_obj = 1 evt_resolve_ad_ds = PDC checkpointInterval = 5 # suppress message text, we only want the event number. suppress_text = 1 # only index events with these event IDs. whitelist = 0-2000,2001-10000 # exclude these event IDs from being indexed. blacklist = 2001-3000 8 field from events and throughput performance (the number of events processed per second) improves.

falsewhitelist = key= [key=] ... 0

Whether or not to exclude the whitelist = key= [key=] ... 1 field from events.

This is an advanced setting. Contact Splunk Support before you change it.

When set to true, the input excludes the whitelist = key= [key=] ... 1 field from events and throughput performance (the number of events processed per second) improves.

falsewhitelist = key= [key=] ... 3

Whether or not to exclude the whitelist = key= [key=] ... 4 field from events.

This is an advanced setting. Contact Splunk Support before you change it.

When set to true, the input excludes the whitelist = key= [key=] ... 4 field from events and throughput performance (the number of events processed per second) improves.

falsewhitelist = key= [key=] ... 6

Whether to index events that match the specified text string. This attribute is optional.

You can specify one of two formats:

• One or more Event Log event codes or event IDs (Event Code/ID format.)
• One or more sets of keys and regular expressions (Advanced filtering format.)

You cannot mix formats in a single entry. You also cannot mix formats in the same stanza.

Allow lists are processed first, then deny lists. If no allow list is present, the Splunk platform indexes all events. If a file matches the regexes in both the deny list and allow list settings, the file is NOT monitored. Deny lists take precedence over allow lists.

When you use the Event Code/ID format:

• For multiple codes/IDs, separate the list with commas.
• For ranges, use hyphens (for example "0-1000,5000-1000").

When using the advanced filtering format:

• Use whitelist = key= [key=] ... 7 between the key and the regular expression that represents your filter (for example whitelist = key= [key=] ... 8
• You can have multiple key/regular expression sets in a single advanced filtering entry. The Splunk platform conjuncts the sets logically. This means that the entry is valid only if all of the sets in the entry are true.
• You can specify up to 10 whitelists per stanza by adding a number to the end of the whitelist = key= [key=] ... 6 attribute, for example [default] _meta = hf_proxy::meta_test [WinEventLog] host = WIN2K16_DC index = wineventlog [WinEventLog://Application] disabled = 0 _meta = hf_proxy::meta_test 00.

N/A[default] _meta = hf_proxy::meta_test [WinEventLog] host = WIN2K16_DC index = wineventlog [WinEventLog://Application] disabled = 0 _meta = hf_proxy::meta_test 01

Do not index events that match the text string specified. This attribute is optional.

You can specify one of two formats:

• One or more Event Log event codes or event IDs (Event Log code/ID format.)
• One or more sets of keys and regular expressions. (Advanced filtering format.)

You cannot mix formats in a single entry. You also cannot mix formats in the same stanza.

Allow lists are processed first, then deny lists. If no deny list is present, the Splunk platform indexes all events.

When using the Event Log code/ID format:

• For multiple codes/IDs, separate the list with commas.
• For ranges, use hyphens (for example [default] _meta = hf_proxy::meta_test [WinEventLog] host = WIN2K16_DC index = wineventlog [WinEventLog://Application] disabled = 0 _meta = hf_proxy::meta_test 02).

When using the advanced filtering format:

• Use whitelist = key= [key=] ... 7 between the key and the regular expression that represents your filter (for example [default] _meta = hf_proxy::meta_test [WinEventLog] host = WIN2K16_DC index = wineventlog [WinEventLog://Application] disabled = 0 _meta = hf_proxy::meta_test 04
• You can have multiple key/regular expression sets in a single advanced filtering entry. The Splunk platform conjuncts the sets logically. This means that the entry is valid only if all of the sets in the entry are true.
• You can specify up to 10 deny lists per stanza by adding a number to the end of the [default] _meta = hf_proxy::meta_test [WinEventLog] host = WIN2K16_DC index = wineventlog [WinEventLog://Application] disabled = 0 _meta = hf_proxy::meta_test 01 attribute, for example [default] _meta = hf_proxy::meta_test [WinEventLog] host = WIN2K16_DC index = wineventlog [WinEventLog://Application] disabled = 0 _meta = hf_proxy::meta_test 06.

[default] _meta = hf_proxy::meta_test [WinEventLog] host = WIN2K16_DC index = wineventlog [WinEventLog://Application] disabled = 0 _meta = hf_proxy::meta_test 07Render event data as extensible markup language (XML) supplied by the Windows Event Log subsystem. This setting is optional.

A value of [WinEventLog://Microsoft-Windows-TaskScheduler/Operational] disabled = 0 2 or [default] _meta = hf_proxy::meta_test [WinEventLog] host = WIN2K16_DC index = wineventlog [WinEventLog://Application] disabled = 0 _meta = hf_proxy::meta_test 09 means to render the events as XML. A value of [WinEventLog://Microsoft-Windows-TaskScheduler/Operational] disabled = 0 7 or [WinEventLog://Security] disabled = 0 start_from = oldest current_only = 0 evt_resolve_ad_obj = 1 evt_dc_name = boston-dc1.contoso.com checkpointInterval = 5 # suppress message text, we only want the event number. suppress_text = 1 # only index events with these event IDs. whitelist = 0-2000,2001-10000 # exclude these event IDs from being indexed. blacklist = 2001-3000 5 means to render the events as plain text.

If you set [default] _meta = hf_proxy::meta_test [WinEventLog] host = WIN2K16_DC index = wineventlog [WinEventLog://Application] disabled = 0 _meta = hf_proxy::meta_test 07 to [default] _meta = hf_proxy::meta_test [WinEventLog] host = WIN2K16_DC index = wineventlog [WinEventLog://Application] disabled = 0 _meta = hf_proxy::meta_test 09, and if you want to also create allow lists or deny lists to filter event data, you must use the [default] _meta = hf_proxy::meta_test [WinEventLog] host = WIN2K16_DC index = wineventlog [WinEventLog://Application] disabled = 0 _meta = hf_proxy::meta_test 14 special key in your allow lists or deny lists.

0 (false)[default] _meta = hf_proxy::meta_test [WinEventLog] host = WIN2K16_DC index = wineventlog [WinEventLog://Application] disabled = 0 _meta = hf_proxy::meta_test 15The index that this input is to send the data to.the default index[default] _meta = hf_proxy::meta_test [WinEventLog] host = WIN2K16_DC index = wineventlog [WinEventLog://Application] disabled = 0 _meta = hf_proxy::meta_test 16

Whether or not the input is to run.

Valid values are [WinEventLog://Microsoft-Windows-TaskScheduler/Operational] disabled = 0 7, meaning that the input is to run, and [WinEventLog://Microsoft-Windows-TaskScheduler/Operational] disabled = 0 2, meaning that the input is to not run.

0

Use the Security event log to monitor changes to files

You can monitor changes to files on your system by enabling security auditing on a set of files or directories and then monitoring the Security event log channel for change events. The event log monitoring input includes three attributes which you can use in inputs.conf. For example:

[WinEventLog://Security] disabled = 0 start_from = oldest current_only = 0 evt_resolve_ad_obj = 1 checkpointInterval = 5 # only index events with these event IDs. whitelist = 0-2000,3001-10000 # exclude these event IDs from being indexed. blacklist = 2001-3000

To enable security auditing for a set of files or directories, read Auditing Security Events How To on MS Technet at //technet.microsoft.com/en-us/library/cc727935%28v=ws.10%29.aspx.

You can also use the [WinEventLog://Security] disabled = 0 start_from = oldest current_only = 0 evt_resolve_ad_obj = 1 evt_dc_name = boston-dc1.contoso.com checkpointInterval = 5 # suppress message text, we only want the event number. suppress_text = 1 # only index events with these event IDs. whitelist = 0-2000,2001-10000 # exclude these event IDs from being indexed. blacklist = 2001-3000 3 attribute to include or exclude the message text that comes with a security event.

When you set [WinEventLog://Security] disabled = 0 start_from = oldest current_only = 0 evt_resolve_ad_obj = 1 evt_dc_name = boston-dc1.contoso.com checkpointInterval = 5 # suppress message text, we only want the event number. suppress_text = 1 # only index events with these event IDs. whitelist = 0-2000,2001-10000 # exclude these event IDs from being indexed. blacklist = 2001-3000 3 to 1 in a Windows Event Log Security stanza, the entire message text does not get indexed, including any contextual information about the security event. If you need this contextual information, do not set [WinEventLog://Security] disabled = 0 start_from = oldest current_only = 0 evt_resolve_ad_obj = 1 evt_dc_name = boston-dc1.contoso.com checkpointInterval = 5 # suppress message text, we only want the event number. suppress_text = 1 # only index events with these event IDs. whitelist = 0-2000,2001-10000 # exclude these event IDs from being indexed. blacklist = 2001-3000 3 in the stanza.

See the following example to include or exclude message text:

[WinEventLog://Security] disabled = 0 start_from = oldest current_only = 0 evt_resolve_ad_obj = 1 checkpointInterval = 5 # suppress message text, we only want the event number. suppress_text = 1 # only index events with these event IDs. whitelist = 0-2000,2001-10000 # exclude these event IDs from being indexed. blacklist = 2001-3000

To use a specific domain controller, set the # Windows platform specific input processor. [WinEventLog://Application] disabled = 0 [WinEventLog://Security] disabled = 0 [WinEventLog://System] disabled = 0 6 attribute:

[WinEventLog://Security] disabled = 0 start_from = oldest current_only = 0 evt_resolve_ad_obj = 1 evt_dc_name = boston-dc1.contoso.com checkpointInterval = 5 # suppress message text, we only want the event number. suppress_text = 1 # only index events with these event IDs. whitelist = 0-2000,2001-10000 # exclude these event IDs from being indexed. blacklist = 2001-3000

To use the primary domain controller to resolve AD objects, set the [WinEventLog://Security] disabled = 0 start_from = oldest current_only = 0 evt_resolve_ad_obj = 1 checkpointInterval = 5 # only index events with these event IDs. whitelist = 0-2000,3001-10000 # exclude these event IDs from being indexed. blacklist = 2001-3000 2 attribute to [WinEventLog://Security] disabled = 0 start_from = oldest current_only = 0 evt_resolve_ad_obj = 1 checkpointInterval = 5 # only index events with these event IDs. whitelist = 0-2000,3001-10000 # exclude these event IDs from being indexed. blacklist = 2001-3000 7. Otherwise, it locates the nearest domain controller.

[WinEventLog://Security] disabled = 0 start_from = oldest current_only = 0 evt_resolve_ad_obj = 1 evt_resolve_ad_ds = PDC checkpointInterval = 5 # suppress message text, we only want the event number. suppress_text = 1 # only index events with these event IDs. whitelist = 0-2000,2001-10000 # exclude these event IDs from being indexed. blacklist = 2001-3000

Create advanced filters with the 'whitelist' and 'blacklist' settings

You can perform advanced filtering of incoming events with the whitelist = key= [key=] ... 6 and [default] _meta = hf_proxy::meta_test [WinEventLog] host = WIN2K16_DC index = wineventlog [WinEventLog://Application] disabled = 0 _meta = hf_proxy::meta_test 01 settings in addition to filtering based solely on event codes. To do this, specify the key/regular expression format in the setting:

whitelist = key= [key=] ...

In this format, [default] _meta = hf_proxy::meta_test [WinEventLog] host = WIN2K16_DC index = wineventlog [WinEventLog://Application] disabled = 0 _meta = hf_proxy::meta_test 27 must be a valid entry from the following table:

KeyDescription$TimeGeneratedThe time that the computer generated the event. Splunk Enterprise only generates the time string as the event.$TimestampThe time that the event was received and recorded by the Event Log service. Splunk Enterprise only generates the time string as the event.$XmlRegexA special key that configures Splunk Enterprise to match incoming events in XML format. See later in this topic for help on using this key.CategoryThe category number for a specific event source.CategoryStringA string translation of the category. The translation depends on the event source.ComputerNameThe name of the computer that generated the event.EventCodeThe event ID number for an event. Corresponds to Event ID in Event Viewer.EventTypeA numeric value that represents one of the five types of events that can be logged: Error, Warning, Information, Success Audit, and Failure Audit. Available only on machines that run Windows Server 2003 and lower or clients running Windows XP and lower. See Win32_NTLogEvent class (Windows) on MSDN at //msdn.microsoft.com/en-us/library/aa394226(v=vs.85).aspx.KeywordsAn element used to classify different types of events within an event log channel. The Security Event Log channel has this element, for example.LogNameThe name of the Event Log channel that received the event. Corresponds to Log Name in Event Viewer.MessageThe text of the message in the event.OpCodeThe severity level of the event. Corresponds to OpCode in Event Viewer.RecordNumberThe Windows Event Log record number. Each event on a Windows machine gets a record number. This number starts at 0 with the first event generated on the system, and increases with each new event generated, until it reaches a maximum of 4294967295. It then rolls back over to 0.SidThe Security Identifier (SID) of the principal, such as a user, group, computer, or other entity, that was associated with or generated the event. See Win32_UserAccount class on MSDN at //msdn.microsoft.com/en-us/library/windows/desktop/aa394507%28v=vs.85%29.aspx.SidTypeA numeric value that represents the type of SID that was associated with the event. See Win32_UserAccount class on MSDN at //msdn.microsoft.com/en-us/library/windows/desktop/aa394507%28v=vs.85%29.aspx.SourceNameThe source of the entity that generated the event. Corresponds to Source in Event Viewer.TaskCategoryThe task category of the event. Event sources let you define categories so that you can filter them with Event Viewer using the [default] _meta = hf_proxy::meta_test [WinEventLog] host = WIN2K16_DC index = wineventlog [WinEventLog://Application] disabled = 0 _meta = hf_proxy::meta_test 28 field. See Event Categories (Windows) on MSDN at //msdn.microsoft.com/en-us/library/aa363649%28VS.85%29.aspx.TypeA numeric value that represents one of the five types of events that can be logged: Error, Warning, Information, Success Audit, and Failure Audit. Only available on machines that run Windows Server 2008 or higher, or Windows Vista or higher. See Win32_NTLogEvent class (Windows) on MSDN at //msdn.microsoft.com/en-us/library/aa394226(v=vs.85).aspx.UserThe user associated with the event. Correlates to User in Event Viewer.

[default] _meta = hf_proxy::meta_test [WinEventLog] host = WIN2K16_DC index = wineventlog [WinEventLog://Application] disabled = 0 _meta = hf_proxy::meta_test 29 is any valid regular expression that represents the filters that you want to include, when you use the filter with the whitelist = key= [key=] ... 6 setting, or exclude, when you use the filter with the [default] _meta = hf_proxy::meta_test [WinEventLog] host = WIN2K16_DC index = wineventlog [WinEventLog://Application] disabled = 0 _meta = hf_proxy::meta_test 01 setting.

You can specify more than one key/regular expression set on a single entry line. When you do this, Splunk Enterprise logically joins the sets. This means that only events that satisfy all of the sets on the line are valid for inclusion or exclusion. See the following examples:

[default] _meta = hf_proxy::meta_test [WinEventLog] host = WIN2K16_DC index = wineventlog [WinEventLog://Application] disabled = 0 _meta = hf_proxy::meta_test 0

means to include events that have an [default] _meta = hf_proxy::meta_test [WinEventLog] host = WIN2K16_DC index = wineventlog [WinEventLog://Application] disabled = 0 _meta = hf_proxy::meta_test 32 ranging from 10 to 15 and contain a [default] _meta = hf_proxy::meta_test [WinEventLog] host = WIN2K16_DC index = wineventlog [WinEventLog://Application] disabled = 0 _meta = hf_proxy::meta_test 33 that begins with the word [default] _meta = hf_proxy::meta_test [WinEventLog] host = WIN2K16_DC index = wineventlog [WinEventLog://Application] disabled = 0 _meta = hf_proxy::meta_test 34.

You can specify up to 10 separate allow list or deny list entries in each stanza. To do so, add a number at the end of the whitelist = key= [key=] ... 6 or [default] _meta = hf_proxy::meta_test [WinEventLog] host = WIN2K16_DC index = wineventlog [WinEventLog://Application] disabled = 0 _meta = hf_proxy::meta_test 01 entry on a separate line:

[default] _meta = hf_proxy::meta_test [WinEventLog] host = WIN2K16_DC index = wineventlog [WinEventLog://Application] disabled = 0 _meta = hf_proxy::meta_test 1

You cannot specify an entry that has more than one key/regular expression set that references the same key. If, for example, you specify:

[default] _meta = hf_proxy::meta_test [WinEventLog] host = WIN2K16_DC index = wineventlog [WinEventLog://Application] disabled = 0 _meta = hf_proxy::meta_test 37

Splunk Enterprise ignores the first set and only attempts to include events that match the second set. In this case, only events that contain an [default] _meta = hf_proxy::meta_test [WinEventLog] host = WIN2K16_DC index = wineventlog [WinEventLog://Application] disabled = 0 _meta = hf_proxy::meta_test 32 between 20 and 25 match. Events that contain an [default] _meta = hf_proxy::meta_test [WinEventLog] host = WIN2K16_DC index = wineventlog [WinEventLog://Application] disabled = 0 _meta = hf_proxy::meta_test 32 between 10 and 15 do not match. Only the last set in the entry ever matches. To resolve this problem, specify two separate entries in the stanza:

[default] _meta = hf_proxy::meta_test [WinEventLog] host = WIN2K16_DC index = wineventlog [WinEventLog://Application] disabled = 0 _meta = hf_proxy::meta_test 40
[default] _meta = hf_proxy::meta_test [WinEventLog] host = WIN2K16_DC index = wineventlog [WinEventLog://Application] disabled = 0 _meta = hf_proxy::meta_test 41

Filter data in XML format with the XmlRegex key

The [default] _meta = hf_proxy::meta_test [WinEventLog] host = WIN2K16_DC index = wineventlog [WinEventLog://Application] disabled = 0 _meta = hf_proxy::meta_test 42 special key lets you use an allow or deny list to filter Windows Event Log events that are in XML format.

To use this key to filter XML-formatted events, do the following:

1. Configure the Windows Event Log input to render events in XML by setting [default] _meta = hf_proxy::meta_test [WinEventLog] host = WIN2K16_DC index = wineventlog [WinEventLog://Application] disabled = 0 _meta = hf_proxy::meta_test 07 to [default] _meta = hf_proxy::meta_test [WinEventLog] host = WIN2K16_DC index = wineventlog [WinEventLog://Application] disabled = 0 _meta = hf_proxy::meta_test 09 in the Windows Event Log input stanza.
2. In the allow list or deny list filter, as you define using either the [default] _meta = hf_proxy::meta_test [WinEventLog] host = WIN2K16_DC index = wineventlog [WinEventLog://Application] disabled = 0 _meta = hf_proxy::meta_test 45 or [default] _meta = hf_proxy::meta_test [WinEventLog] host = WIN2K16_DC index = wineventlog [WinEventLog://Application] disabled = 0 _meta = hf_proxy::meta_test 46 settings, supply an [default] _meta = hf_proxy::meta_test [WinEventLog] host = WIN2K16_DC index = wineventlog [WinEventLog://Application] disabled = 0 _meta = hf_proxy::meta_test 42 key with a regular expression value (regex) on which you want the Splunk platform to filter events.

The key and the regular expression value comprise an entry in the allow or deny list. Because the key requires that you first render Windows Event Log events in XML format, you must use regexes as the values for the [default] _meta = hf_proxy::meta_test [WinEventLog] host = WIN2K16_DC index = wineventlog [WinEventLog://Application] disabled = 0 _meta = hf_proxy::meta_test 14 key to filter the XML. Because regexes can contain quotes, slashes, and other characters, you must surround regexes with characters that demarcate the regex from the rest of the elements in the allow or deny list entry. These demarcation characters can be any character except a space, but cannot be part of the regex itself. For example:

Here, the demarcation character is the plus sign ([default] _meta = hf_proxy::meta_test [WinEventLog] host = WIN2K16_DC index = wineventlog [WinEventLog://Application] disabled = 0 _meta = hf_proxy::meta_test 49). It separates the regex [default] _meta = hf_proxy::meta_test [WinEventLog] host = WIN2K16_DC index = wineventlog [WinEventLog://Application] disabled = 0 _meta = hf_proxy::meta_test 50 from the [default] _meta = hf_proxy::meta_test [WinEventLog] host = WIN2K16_DC index = wineventlog [WinEventLog://Application] disabled = 0 _meta = hf_proxy::meta_test 14 key.

You can specify multiple [default] _meta = hf_proxy::meta_test [WinEventLog] host = WIN2K16_DC index = wineventlog [WinEventLog://Application] disabled = 0 _meta = hf_proxy::meta_test 14 entries in a single allow or deny list. To do this, add another [default] _meta = hf_proxy::meta_test [WinEventLog] host = WIN2K16_DC index = wineventlog [WinEventLog://Application] disabled = 0 _meta = hf_proxy::meta_test 53 entry to the allow or deny list line. The Splunk platform logically joins these entries within the allow or deny list. This means that each of the [default] _meta = hf_proxy::meta_test [WinEventLog] host = WIN2K16_DC index = wineventlog [WinEventLog://Application] disabled = 0 _meta = hf_proxy::meta_test 42 entries within the allow or deny list must evaluate as true for the allow or deny list as a whole to evaluate as true. Other entries in the same allow or deny list can cause the list to evaluate as false and not filter the events as you want.

Following is an example of how to use the [default] _meta = hf_proxy::meta_test [WinEventLog] host = WIN2K16_DC index = wineventlog [WinEventLog://Application] disabled = 0 _meta = hf_proxy::meta_test 14 special key:

[default] _meta = hf_proxy::meta_test [WinEventLog] host = WIN2K16_DC index = wineventlog [WinEventLog://Application] disabled = 0 _meta = hf_proxy::meta_test 2

means to match events whose event codes end in 44, and contain the words "Error" and "something" somewhere in the XML formatted message.

Suppress fields from Windows Event Log events

There are two options to limit the ingestion of data by removing Windows Event Log fields from events that a Splunk Platform instance ingests:

• Use the [WinEventLog://Security] disabled = 0 start_from = oldest current_only = 0 evt_resolve_ad_obj = 1 evt_dc_name = boston-dc1.contoso.com checkpointInterval = 5 # suppress message text, we only want the event number. suppress_text = 1 # only index events with these event IDs. whitelist = 0-2000,2001-10000 # exclude these event IDs from being indexed. blacklist = 2001-3000 2 settings in inputs.conf to remove certain Windows Event Log fields from ingested events.
• Use the [WinEventLog://Security] disabled = 0 start_from = oldest current_only = 0 evt_resolve_ad_obj = 1 evt_dc_name = boston-dc1.contoso.com checkpointInterval = 5 # suppress message text, we only want the event number. suppress_text = 1 # only index events with these event IDs. whitelist = 0-2000,2001-10000 # exclude these event IDs from being indexed. blacklist = 2001-3000 1 setting, which lets you remove any Windows Event Log field from a Windows Event Log event. This setting removes both the excluded key and value from the event, and excludes events even if the field exists in an allow list.

You define both of these settings in the inputs.conf configuration file, under a Windows Event Log monitoring input, for example:

[WinEventLog://Security] disabled = 0 start_from = oldest current_only = 0 evt_resolve_ad_obj = 1 evt_dc_name = boston-dc1.contoso.com checkpointInterval = 5 # suppress message text, we only want the event number. suppress_text = 1 # only index events with these event IDs. whitelist = 0-2000,2001-10000 # exclude these event IDs from being indexed. blacklist = 2001-3000 2 example (suppresses the message text)

[default] _meta = hf_proxy::meta_test [WinEventLog] host = WIN2K16_DC index = wineventlog [WinEventLog://Application] disabled = 0 _meta = hf_proxy::meta_test 3

[WinEventLog://Security] disabled = 0 start_from = oldest current_only = 0 evt_resolve_ad_obj = 1 evt_dc_name = boston-dc1.contoso.com checkpointInterval = 5 # suppress message text, we only want the event number. suppress_text = 1 # only index events with these event IDs. whitelist = 0-2000,2001-10000 # exclude these event IDs from being indexed. blacklist = 2001-3000 1 example

[default] _meta = hf_proxy::meta_test [WinEventLog] host = WIN2K16_DC index = wineventlog [WinEventLog://Application] disabled = 0 _meta = hf_proxy::meta_test 4

See the list of fields in "Create advanced filters with 'whitelist' and 'blacklist'" earlier in this topic. See "Configuration settings for monitoring Windows Event Logs", also earlier in this topic, for more information about the settings.

Resolve Active Directory objects in event log files

To specify whether Active Directory objects like globally unique identifiers (GUIDs) and security identifiers (SIDs) are resolved for a given Windows event log channel, use the [WinEventLog://Security] disabled = 0 start_from = oldest current_only = 0 evt_resolve_ad_obj = 1 checkpointInterval = 5 # only index events with these event IDs. whitelist = 0-2000,3001-10000 # exclude these event IDs from being indexed. blacklist = 2001-3000 3 attribute (1=enabled, 0=disabled) for that channel's stanza in your local copy of inputs.conf. The [WinEventLog://Security] disabled = 0 start_from = oldest current_only = 0 evt_resolve_ad_obj = 1 checkpointInterval = 5 # only index events with these event IDs. whitelist = 0-2000,3001-10000 # exclude these event IDs from being indexed. blacklist = 2001-3000 3 attribute is on by default for the Security channel.

For example:

[default] _meta = hf_proxy::meta_test [WinEventLog] host = WIN2K16_DC index = wineventlog [WinEventLog://Application] disabled = 0 _meta = hf_proxy::meta_test 5

To specify a domain controller for the domain that the Splunk platform instance is to bind to in order to resolve AD objects, use the # Windows platform specific input processor. [WinEventLog://Application] disabled = 0 [WinEventLog://Security] disabled = 0 [WinEventLog://System] disabled = 0 6 attribute.

The string specified in the # Windows platform specific input processor. [WinEventLog://Application] disabled = 0 [WinEventLog://Security] disabled = 0 [WinEventLog://System] disabled = 0 6 attribute can represent either the domain controller NetBIOS name, or its fully-qualified domain name (FQDN). Either name type can, optionally, be preceded by two backslash characters.

The following examples are correctly formatted domain controller names:

• [default] _meta = hf_proxy::meta_test [WinEventLog] host = WIN2K16_DC index = wineventlog [WinEventLog://Application] disabled = 0 _meta = hf_proxy::meta_test 64
• [default] _meta = hf_proxy::meta_test [WinEventLog] host = WIN2K16_DC index = wineventlog [WinEventLog://Application] disabled = 0 _meta = hf_proxy::meta_test 65
• [default] _meta = hf_proxy::meta_test [WinEventLog] host = WIN2K16_DC index = wineventlog [WinEventLog://Application] disabled = 0 _meta = hf_proxy::meta_test 66
• [default] _meta = hf_proxy::meta_test [WinEventLog] host = WIN2K16_DC index = wineventlog [WinEventLog://Application] disabled = 0 _meta = hf_proxy::meta_test 67

To specify the FQDN of the domain to bind to, use the [WinEventLog://Security] disabled = 0 start_from = oldest current_only = 0 evt_resolve_ad_obj = 1 evt_dc_name = boston-dc1.contoso.com checkpointInterval = 5 # suppress message text, we only want the event number. suppress_text = 1 # only index events with these event IDs. whitelist = 0-2000,2001-10000 # exclude these event IDs from being indexed. blacklist = 2001-3000 0 attribute.

For example:

[default] _meta = hf_proxy::meta_test [WinEventLog] host = WIN2K16_DC index = wineventlog [WinEventLog://Application] disabled = 0 _meta = hf_proxy::meta_test 6

When you use the [WinEventLog://Security] disabled = 0 start_from = oldest current_only = 0 evt_resolve_ad_obj = 1 checkpointInterval = 5 # only index events with these event IDs. whitelist = 0-2000,3001-10000 # exclude these event IDs from being indexed. blacklist = 2001-3000 3 and # Windows platform specific input processor. [WinEventLog://Application] disabled = 0 [WinEventLog://Security] disabled = 0 [WinEventLog://System] disabled = 0 6 attributes, the following constraints apply:

• Splunk software first attempts to resolve SIDs and GUIDs using the domain controller (DC) specified in the # Windows platform specific input processor. [WinEventLog://Application] disabled = 0 [WinEventLog://Security] disabled = 0 [WinEventLog://System] disabled = 0 6 attribute first. If it cannot resolve SIDs using this DC, it attempts to bind to the default DC to perform the translation.
• If Splunk software cannot contact a DC to translate SIDs, it attempts to use the local machine for translation.
• If none of these methods works, then Splunk prints the SID as it was captured in the event.
• Splunk software cannot translate SIDs that are not in the format [default] _meta = hf_proxy::meta_test [WinEventLog] host = WIN2K16_DC index = wineventlog [WinEventLog://Application] disabled = 0 _meta = hf_proxy::meta_test 72.

If you discover that SIDs are not being translated properly, review [default] _meta = hf_proxy::meta_test [WinEventLog] host = WIN2K16_DC index = wineventlog [WinEventLog://Application] disabled = 0 _meta = hf_proxy::meta_test 73 for clues about what the problem might be.

Specify whether to start index at the earliest or the most recent event

Use the [WinEventLog://DNS Server] disabled = 0 [WinEventLog://Directory Service] disabled = 0 [WinEventLog://File Replication Service] disabled = 0 7 attribute to specify whether events are indexed starting at the earliest event or the most recent. By default, indexing starts with the oldest data and moves forward. Do not change this setting, because Splunk software stops indexing after it has indexed the backlog using this method.

Use the [WinEventLog://Microsoft-Windows-TaskScheduler/Operational] disabled = 0 1 attribute to specify whether to index all preexisting events in a given log channel. When set to 1, only events that appear from the moment the Splunk deployment was started are indexed. When set to 0, all events are indexed.

For example:

[default] _meta = hf_proxy::meta_test [WinEventLog] host = WIN2K16_DC index = wineventlog [WinEventLog://Application] disabled = 0 _meta = hf_proxy::meta_test 7

Display Windows Event Log events in XML

To have Splunk Enterprise generate Windows Event Log events in XML, use the [default] _meta = hf_proxy::meta_test [WinEventLog] host = WIN2K16_DC index = wineventlog [WinEventLog://Application] disabled = 0 _meta = hf_proxy::meta_test 07 setting in a Windows Event Log input stanza:

[default] _meta = hf_proxy::meta_test [WinEventLog] host = WIN2K16_DC index = wineventlog [WinEventLog://Application] disabled = 0 _meta = hf_proxy::meta_test 8

This input stanza generates events like the following:

[default] _meta = hf_proxy::meta_test [WinEventLog] host = WIN2K16_DC index = wineventlog [WinEventLog://Application] disabled = 0 _meta = hf_proxy::meta_test 9

When you instruct Splunk Enterprise to render events in XML, event keys within the XML event render in English regardless of the machine system locale. Compare the following events generated on a French version of Windows Server.

Standard event:

# Windows platform specific input processor. [WinEventLog://Application] disabled = 0 [WinEventLog://Security] disabled = 0 [WinEventLog://System] disabled = 0 0

XML event:

# Windows platform specific input processor. [WinEventLog://Application] disabled = 0 [WinEventLog://Security] disabled = 0 [WinEventLog://System] disabled = 0 1

The [default] _meta = hf_proxy::meta_test [WinEventLog] host = WIN2K16_DC index = wineventlog [WinEventLog://Application] disabled = 0 _meta = hf_proxy::meta_test 77 keys in the XML event render in English despite rendering in the system's native language in the standard event.

Use allow lists and deny lists to filter on XML-based events

If you render events in XML, and you want to use allow lists and deny lists to filter on those events, you must use the special key [default] _meta = hf_proxy::meta_test [WinEventLog] host = WIN2K16_DC index = wineventlog [WinEventLog://Application] disabled = 0 _meta = hf_proxy::meta_test 14 when you build your allow lists or deny lists.

The allow list or deny list triggers when Splunk Enterprise finds the value that you specify with [default] _meta = hf_proxy::meta_test [WinEventLog] host = WIN2K16_DC index = wineventlog [WinEventLog://Application] disabled = 0 _meta = hf_proxy::meta_test 14 anywhere in the XML-rendered event. [default] _meta = hf_proxy::meta_test [WinEventLog] host = WIN2K16_DC index = wineventlog [WinEventLog://Application] disabled = 0 _meta = hf_proxy::meta_test 14 doesn't work if you don't explicitly specify the input to render events in XML with the [default] _meta = hf_proxy::meta_test [WinEventLog] host = WIN2K16_DC index = wineventlog [WinEventLog://Application] disabled = 0 _meta = hf_proxy::meta_test 81 setting.

The [default] _meta = hf_proxy::meta_test [WinEventLog] host = WIN2K16_DC index = wineventlog [WinEventLog://Application] disabled = 0 _meta = hf_proxy::meta_test 14 setting doesn't search for key-value pairs. It configures Splunk Enterprise to expect incoming events in XML format.

The following example configures the whitelist = key= [key=] ... 6 setting to allow XML events. Splunk Enterprise indexes all XML events that contain the word "Error":

# Windows platform specific input processor. [WinEventLog://Application] disabled = 0 [WinEventLog://Security] disabled = 0 [WinEventLog://System] disabled = 0 2

See the section earlier in this topic for additional information and syntax.

Use the CLI to configure event log monitoring

You can use the CLI to configure local event log monitoring. Before you use the CLI, create stanza entries in inputs.conf first. See in this topic.

The CLI is not available for remote Event Log collections.

To list all configured Event Log channels on the local machine, enter the following:

You can also list a specific channel by specifying its name as in the following example:

# Windows platform specific input processor. [WinEventLog://Application] disabled = 0 [WinEventLog://Security] disabled = 0 [WinEventLog://System] disabled = 0 3

To enable an Event Log channel, enter the following:

# Windows platform specific input processor. [WinEventLog://Application] disabled = 0 [WinEventLog://Security] disabled = 0 [WinEventLog://System] disabled = 0 4

To disable a channel, enter the following:

# Windows platform specific input processor. [WinEventLog://Application] disabled = 0 [WinEventLog://Security] disabled = 0 [WinEventLog://System] disabled = 0 5

Index exported event log files

To index exported Windows event log (.evt or .evtx) files, monitor the directory that contains the exported files. See Monitor files and directories.

Do not attempt to monitor an .evt or .evtx file that is open for writing. Windows does not allow read access to these files. Use the event log monitoring feature instead.

Constraints for monitoring Windows Event log files directly

Directly monitoring Windows Event log files have the following constraints:

• As a result of API and log channel processing constraints on Windows XP and Server 2003 systems, imported .evt files from those systems do not contain the [default] _meta = hf_proxy::meta_test [WinEventLog] host = WIN2K16_DC index = wineventlog [WinEventLog://Application] disabled = 0 _meta = hf_proxy::meta_test 33 field. This means that the contents of the [default] _meta = hf_proxy::meta_test [WinEventLog] host = WIN2K16_DC index = wineventlog [WinEventLog://Application] disabled = 0 _meta = hf_proxy::meta_test 33 field do not appear in your index.
• Splunk Enterprise on Windows XP and Windows Server 2003/2003 R2 cannot index .evtx files that come from systems running Windows Vista and higher or Windows Server 2008/2008 R2 and higher.
• Splunk Enterprise on Windows Vista and higher and Server 2008/2008 R2 and higher can index both .evt and .evtx files.
• If your .evt or .evtx file is not from a standard event log channel, you must make sure that any dynamic link library (DLL) files required by that channel are present on the computer on which you are indexing.
• Splunk Enterprise indexes an .evt or .evtx file in the primary locale and language of the computer that collects the file.
• Files that you export from another machine do not work with the Splunk Web Upload feature. This is because those files contain information that is specific to the machine that generated them. Other machines cannot process the files in their unaltered form.

When producing .evt or .evtx files on one system, and monitoring them on another, it's possible that not all of the fields in each event expand as they would on the system producing the events. This is caused by variations in DLL versions, availability, and APIs. Differences in OS version, language, Service Pack level, and installed third-party DLLs can also have this effect.

Which of the following ports is used by Remote Assistance and Remote Desktop?

What can you create in Event Viewer to display specific types of events from one or more event logs quizlet?

Can Remote Desktop Connection be monitored?

Which of the following statements best describes a solution that relieves a performance bottleneck or increases overall performance?