https://community.splunk.com/t5/Getting-Data-In/Disable-Windows-application-Events-and-allow-only-specific-event/m-p/564867#M100543 <P>you can give whitelist attribute in monitoring stanza for application events -<BR /><BR />For ref -&nbsp;<A href="https://docs.splunk.com/Documentation/SplunkCloud/8.2.2106/Data/MonitorWindowseventlogdata" target="_blank">https://docs.splunk.com/Documentation/SplunkCloud/8.2.2106/Data/MonitorWindowseventlogdata</A>&nbsp;</P> Thu, 26 Aug 2021 11:55:52 GMT shugup2923 2021-08-26T11:55:52Z https://community.splunk.com/t5/Getting-Data-In/Disable-Windows-application-Events-and-allow-only-specific-event/m-p/564819#M100534 <P>Hi All,</P><P>Can anyone advise me on below</P><P>I have Windows Application logs disabled already but I need one event ID that should be allowed.&nbsp;</P> Thu, 26 Aug 2021 03:19:09 GMT https://community.splunk.com/t5/Getting-Data-In/Disable-Windows-application-Events-and-allow-only-specific-event/m-p/564819#M100534 abhic25 2021-08-26T03:19:09Z https://community.splunk.com/t5/Getting-Data-In/Disable-Windows-application-Events-and-allow-only-specific-event/m-p/564867#M100543 <P>you can give whitelist attribute in monitoring stanza for application events -<BR /><BR />For ref -&nbsp;<A href="https://docs.splunk.com/Documentation/SplunkCloud/8.2.2106/Data/MonitorWindowseventlogdata" target="_blank">https://docs.splunk.com/Documentation/SplunkCloud/8.2.2106/Data/MonitorWindowseventlogdata</A>&nbsp;</P> Thu, 26 Aug 2021 11:55:52 GMT https://community.splunk.com/t5/Getting-Data-In/Disable-Windows-application-Events-and-allow-only-specific-event/m-p/564867#M100543 shugup2923 2021-08-26T11:55:52Z