How do I block a Process ID for winhostmon. This is what I have in inputs.conf
[WinHostMon://Process]
interval = 600
disabled = 0
type = process
blacklist = ProcessId="0"
index = windows
blacklist is not valid option to WinHostMon. Consider using an Ingest Action to discard the unwanted events.
Thank You I will look at that.
blacklist is not valid option to WinHostMon. Consider using an Ingest Action to discard the unwanted events.
Will using the ingest action to drop those events keep that data from counting against my daily ingest limit or will it just not show up in searches but still ingest the data?
Events that are dropped (not indexed) for any reason do not count against your ingest license.