Input.conf on Deployment App

jonsantos — Tue, 19 Jan 2021 23:14:42 GMT

I created a deployment app (which distributes to Windows Universal Forwarders), from my Linux Deployment Server. Inside Windows\Local\ I have an inputs.conf file looks like this:

[WinEventLog://System]
blacklist = EventCode=xxxx

When the app gets delivered to the Windows Universal Forwarders, the input.conf file in the deployed app looks like this:

[WinEventLog://System]blacklist = EventCode=xxxx

The contents in the Inputs.conf is all in one line causing the blacklisting not to work. Any ideas on what I'm doing wrong?

Jon

Re: Input.conf on Deployment App

scelikok — Wed, 20 Jan 2021 04:48:27 GMT

Hi @jonsantos,

Windows notepad cannot show Linux line endings properly, that should not be a problem. Please try filter with quotes like below;

[WinEventLog://System] blacklist = EventCode="xxxx"

If this reply helps you an upvote is appreciated.

topic Input.conf on Deployment App in Getting Data In

Input.conf on Deployment App

Re: Input.conf on Deployment App