https://community.splunk.com/t5/Getting-Data-In/Why-is-one-Microsoft-Windows-Security-event-shows-up-as/m-p/207651#M40933 <P>I would open support case for sure.</P> Wed, 09 Sep 2015 23:52:34 GMT woodcock 2015-09-09T23:52:34Z https://community.splunk.com/t5/Getting-Data-In/Why-is-one-Microsoft-Windows-Security-event-shows-up-as/m-p/207650#M40932 <P>Started forwarding two specific IAS Security events to Splunk. My inputs.conf stanza on the Universal Forwarder is below. However, in Splunk, one event shows up as 1,047 events over and over again. Is my stanza wrong, or is there something else going on here?</P> <PRE><CODE>[WinEventLog://Security] disabled = 0 start_from = newest current_only = 0 index = radius whitelist = 6272,6273 </CODE></PRE> Wed, 09 Sep 2015 13:31:12 GMT https://community.splunk.com/t5/Getting-Data-In/Why-is-one-Microsoft-Windows-Security-event-shows-up-as/m-p/207650#M40932 mjkenney 2015-09-09T13:31:12Z https://community.splunk.com/t5/Getting-Data-In/Why-is-one-Microsoft-Windows-Security-event-shows-up-as/m-p/207651#M40933 <P>I would open support case for sure.</P> Wed, 09 Sep 2015 23:52:34 GMT https://community.splunk.com/t5/Getting-Data-In/Why-is-one-Microsoft-Windows-Security-event-shows-up-as/m-p/207651#M40933 woodcock 2015-09-09T23:52:34Z https://community.splunk.com/t5/Getting-Data-In/Why-is-one-Microsoft-Windows-Security-event-shows-up-as/m-p/207652#M40934 <P>Well I removed "start_from" and changed current_only from 0 to 1. That fixed it.</P> Tue, 29 Sep 2020 07:15:16 GMT https://community.splunk.com/t5/Getting-Data-In/Why-is-one-Microsoft-Windows-Security-event-shows-up-as/m-p/207652#M40934 mjkenney 2020-09-29T07:15:16Z