Hello
I am using Splunk UF 6.1.4 on my Windows Domain controllers to monitor windows events. I've put in place a working blacklist to filter out a number of events and that works fine. The issue I have is I also want to filter out an EventCode 4776 where the Error_Cdoe is 0x0
**[WinEventLog://Security]
disabled = 0
start_from = oldest
evt_resolve_ad_obj = 1
checkpointInterval = 5
index = soc
ignoreOlderThan = 2d
#whitelist = Category=9
blacklist1 = 4624,4634,4658,4656,4690,4661,4662,5136,5137,538,675,540,566,565,562
blacklist2 = EventCode="4776" Error_Code="0x0"**
As I say the blacklist1 list works,
Or should I be setting blacklist2 to
**blacklist2 = EventCode="4776" Message="Error Code:*0x0"**
↧