https://community.splunk.com/t5/Getting-Data-In/How-do-I-exclude-WinEventsLog-Application-files-from-being/m-p/429113#M75196 <P>Whenever I check the files that have been forwarded to my Splunk index, I see a bunch of files having their <CODE>source = WinEventsLog:Application</CODE>. I did not explicitly put a monitor stanza for such files and I wonder why my forwarder is always sending them to my Splunk instance. When I look at the individual events of the source, they are of the form:</P> <UL> <LI><P><CODE>LogName=Application<BR /> SourceName=Microsoft-Windows-CertificateServicesClient-CertEnroll<BR /> ...</CODE></P></LI> <LI><P><CODE>LogName=Application<BR /> SourceName=Symantec Antivirus<BR /> ...</CODE></P></LI> <LI><P><CODE>LogName=Application<BR /> SourceName=NVWMI<BR /> ...</CODE></P></LI> </UL> <P><CODE>...</CODE> indicates that there are more field-value pairs in the events.</P> <P>How do I exclude or prevent my forwarder from sending files from the <CODE>WinEventsLog:Application</CODE> source? It is clogging my index with data I don't need. Any help would be appreciated. Thanks!</P> Mon, 09 Jul 2018 03:51:13 GMT mawomommoh 2018-07-09T03:51:13Z https://community.splunk.com/t5/Getting-Data-In/How-do-I-exclude-WinEventsLog-Application-files-from-being/m-p/429113#M75196 <P>Whenever I check the files that have been forwarded to my Splunk index, I see a bunch of files having their <CODE>source = WinEventsLog:Application</CODE>. I did not explicitly put a monitor stanza for such files and I wonder why my forwarder is always sending them to my Splunk instance. When I look at the individual events of the source, they are of the form:</P> <UL> <LI><P><CODE>LogName=Application<BR /> SourceName=Microsoft-Windows-CertificateServicesClient-CertEnroll<BR /> ...</CODE></P></LI> <LI><P><CODE>LogName=Application<BR /> SourceName=Symantec Antivirus<BR /> ...</CODE></P></LI> <LI><P><CODE>LogName=Application<BR /> SourceName=NVWMI<BR /> ...</CODE></P></LI> </UL> <P><CODE>...</CODE> indicates that there are more field-value pairs in the events.</P> <P>How do I exclude or prevent my forwarder from sending files from the <CODE>WinEventsLog:Application</CODE> source? It is clogging my index with data I don't need. Any help would be appreciated. Thanks!</P> Mon, 09 Jul 2018 03:51:13 GMT https://community.splunk.com/t5/Getting-Data-In/How-do-I-exclude-WinEventsLog-Application-files-from-being/m-p/429113#M75196 mawomommoh 2018-07-09T03:51:13Z https://community.splunk.com/t5/Getting-Data-In/How-do-I-exclude-WinEventsLog-Application-files-from-being/m-p/429114#M75197 <P>Please look at this answer.</P> <P><A href="https://answers.splunk.com/answers/122268/disable-forwarding-of-windows-event-logs.html">https://answers.splunk.com/answers/122268/disable-forwarding-of-windows-event-logs.html</A></P> Mon, 09 Jul 2018 04:26:42 GMT https://community.splunk.com/t5/Getting-Data-In/How-do-I-exclude-WinEventsLog-Application-files-from-being/m-p/429114#M75197 HiroshiSatoh 2018-07-09T04:26:42Z https://community.splunk.com/t5/Getting-Data-In/How-do-I-exclude-WinEventsLog-Application-files-from-being/m-p/429115#M75198 <P>Thanks for the info!</P> Wed, 11 Jul 2018 19:32:38 GMT https://community.splunk.com/t5/Getting-Data-In/How-do-I-exclude-WinEventsLog-Application-files-from-being/m-p/429115#M75198 mawomommoh 2018-07-11T19:32:38Z