How do I remove Security event logs as one of my data inputs

aywong — Wed, 17 Oct 2012 15:23:12 GMT

When I had initiall installed my forwarder I selected "security" as one of my inputs. Now I want to remove this as an input.

Re: How do I remove Security event logs as one of my data inputs

MHibbin — Wed, 17 Oct 2012 16:03:09 GMT

Assuming you are talking windows here...

There will be an inputs.conf with the Splunk directory on the forwarder. This could be in a system location or an application, so either (where $SPLUNK_HOME is the Splunk installation directory (e.g. D:\Program Files\Splunk\)):

$SPLUNK_HOME\etc\system\local\inputs.conf

$SPLUNK_HOME\etc\apps\<appName>\default\inputs.conf

$SPLUNK_HOME\etc\apps\<appName>\local\inputs.conf

In this file (should be easy to find in windows) there will probably be something like:

[WinEventLog:Security]
disabled = 0

There may be some extra parameters, but you will need to change the "disabled = 0" to "disabled = 1". E.g:

[WinEventLog:Security]
disabled = 1

This will disable that input, you will then need to restart Splunk on the forwarder to make sure that changes are applied.

topic How do I remove Security event logs as one of my data inputs in Getting Data In

How do I remove Security event logs as one of my data inputs

Re: How do I remove Security event logs as one of my data inputs