https://community.splunk.com/t5/Getting-Data-In/Onboard-Windows-event-log-based-on-source-name/m-p/394530#M70433 <P>Hi. How would I ingest Windows Application events from a specific source name (and drop everything else)? For instance, ingest events with source MSSQLSERVER into the mssql index; source MSIINSTALLER into the msi index. It would be done with regex in transforms.conf, right?</P> Wed, 29 May 2019 21:51:02 GMT jasonlow 2019-05-29T21:51:02Z https://community.splunk.com/t5/Getting-Data-In/Onboard-Windows-event-log-based-on-source-name/m-p/394530#M70433 <P>Hi. How would I ingest Windows Application events from a specific source name (and drop everything else)? For instance, ingest events with source MSSQLSERVER into the mssql index; source MSIINSTALLER into the msi index. It would be done with regex in transforms.conf, right?</P> Wed, 29 May 2019 21:51:02 GMT https://community.splunk.com/t5/Getting-Data-In/Onboard-Windows-event-log-based-on-source-name/m-p/394530#M70433 jasonlow 2019-05-29T21:51:02Z https://community.splunk.com/t5/Getting-Data-In/Onboard-Windows-event-log-based-on-source-name/m-p/394531#M70434 <P>Specify the index name in inputs.conf.</P> Thu, 30 May 2019 13:09:20 GMT https://community.splunk.com/t5/Getting-Data-In/Onboard-Windows-event-log-based-on-source-name/m-p/394531#M70434 richgalloway 2019-05-30T13:09:20Z