https://community.splunk.com/t5/Getting-Data-In/editing-input-conf-is-not-reflects-to-system/m-p/160412#M32523 <P>hi manyaeons ,<BR /> try to follow these instructions</P> <P><CODE>input.conf</CODE> copy the file to the <CODE>default folder</CODE>and go stick it in the<CODE>local folder</CODE> and then make the change to put in local <CODE>disabled=1</CODE> <BR /> splunk then restarts. during startup, splunk will first consult the local file before the default folder and take into account the change.<BR /> I hope it will work</P> <P>please forgive my english.</P> Fri, 19 Dec 2014 09:44:45 GMT gyslainlatsa 2014-12-19T09:44:45Z https://community.splunk.com/t5/Getting-Data-In/editing-input-conf-is-not-reflects-to-system/m-p/160410#M32521 <P>hi, i just try to whitelist security log as below but it is not working<BR /> in fact non of these attribute reflects to system <BR /> i tried change to disabled=1 but logs keeps coming (even after restarted) </P> <P>ver: 6.1</P> <PRE><CODE>[WinEventLog://Security] disabled = 0 current_only = 0 evt_resolve_ad_obj = 1 checkpointInterval = 5 whitelist = 4663 </CODE></PRE> Wed, 17 Dec 2014 15:18:30 GMT https://community.splunk.com/t5/Getting-Data-In/editing-input-conf-is-not-reflects-to-system/m-p/160410#M32521 manyaeons 2014-12-17T15:18:30Z https://community.splunk.com/t5/Getting-Data-In/editing-input-conf-is-not-reflects-to-system/m-p/160411#M32522 <P>note:using wmi not forwarder<BR /> and yes it is inputs.conf</P> Thu, 18 Dec 2014 09:20:38 GMT https://community.splunk.com/t5/Getting-Data-In/editing-input-conf-is-not-reflects-to-system/m-p/160411#M32522 manyaeons 2014-12-18T09:20:38Z https://community.splunk.com/t5/Getting-Data-In/editing-input-conf-is-not-reflects-to-system/m-p/160412#M32523 <P>hi manyaeons ,<BR /> try to follow these instructions</P> <P><CODE>input.conf</CODE> copy the file to the <CODE>default folder</CODE>and go stick it in the<CODE>local folder</CODE> and then make the change to put in local <CODE>disabled=1</CODE> <BR /> splunk then restarts. during startup, splunk will first consult the local file before the default folder and take into account the change.<BR /> I hope it will work</P> <P>please forgive my english.</P> Fri, 19 Dec 2014 09:44:45 GMT https://community.splunk.com/t5/Getting-Data-In/editing-input-conf-is-not-reflects-to-system/m-p/160412#M32523 gyslainlatsa 2014-12-19T09:44:45Z