https://community.splunk.com/t5/Splunk-Enterprise/how-to-index-hard-disk-only/m-p/21126#M8450 <P>If your using the windows app, you should be able to comment out the scripted inputs in your under $SPLUNK_HOME\Splunk\etc\apps\windows\local\inputs.conf. Copy the scripted inputs from \Splunk\etc\apps\windows\default\inputs.conf and create a line under each stanza in the local file that says <CODE>'disabled = 1'</CODE></P> Thu, 02 Jun 2011 14:44:50 GMT jbsplunk 2011-06-02T14:44:50Z https://community.splunk.com/t5/Splunk-Enterprise/how-to-index-hard-disk-only/m-p/21125#M8449 <P>guys, i have a little question. <BR /> I've been testing out splunk on windows version server. What i'm after is just retrieve only disk device logs only. the question is can splunk do that? I just need to monitor the disks of the servers. anyone on this subject. thanks advance..</P> Wed, 01 Jun 2011 23:57:10 GMT https://community.splunk.com/t5/Splunk-Enterprise/how-to-index-hard-disk-only/m-p/21125#M8449 li_leejohn 2011-06-01T23:57:10Z https://community.splunk.com/t5/Splunk-Enterprise/how-to-index-hard-disk-only/m-p/21126#M8450 <P>If your using the windows app, you should be able to comment out the scripted inputs in your under $SPLUNK_HOME\Splunk\etc\apps\windows\local\inputs.conf. Copy the scripted inputs from \Splunk\etc\apps\windows\default\inputs.conf and create a line under each stanza in the local file that says <CODE>'disabled = 1'</CODE></P> Thu, 02 Jun 2011 14:44:50 GMT https://community.splunk.com/t5/Splunk-Enterprise/how-to-index-hard-disk-only/m-p/21126#M8450 jbsplunk 2011-06-02T14:44:50Z