filter windows application event by Source

ajaysamantbms — Thu, 29 May 2014 14:50:59 GMT

I am using windows TA app to get events from windows event log.
The windows events are coming inside Indexer.

But i would like to filter them at universal forwarder if possible and get events for a particular source only - and not for all Applications - looking for specific values under "Source"

Source tells me that event is coming from which Application. So i want events only from Source=A and Source=B from windows application event log

Re: filter windows application event by Source

somesoni2 — Thu, 29 May 2014 15:57:47 GMT

See the link below with similar requirement (except that this post is filtering based on EventCode)

http://answers.splunk.com/answers/47168/windows-event-log-filter-attempt-failing

Also, note the fact that this changes have to be done on Indexer as you're using Universal Forwarder.

topic filter windows application event by Source in Splunk Search

filter windows application event by Source

Re: filter windows application event by Source