Index non winevent log sources

[newsplunker1]

Hi, 

I'm trying to index the following sources with the below configs. Im using Splunk UF. Im receiving other logs such as internal , win event security/application so no firewall or communication issues between the client and server 

[WinEventlog://Microsoft-AzureADPasswordProtection-DCAgent/Admin]
index=main
disabled=0

[WinEventlog://Microsoft-AzureADPasswordProtection-DCAgent/Operational]
index = main
disabled = 0

Thanks 

[gcusello]

Hi @newsplunker1 ,

probably it could be a good idea to configure different destination indexes for different kind of logs:

I usually use "wineventlog" for Windows Event logging, "windows" for the other windows data source and "perfmon" for performance monitoring logs.

Even if the main rules to assign an index are Access grants and retention.

And anyway, never use main!

Ciao.

Giuseppe

[newsplunker1]

@gcusello This was just for quick testing in the dev env but in the prod, i do have specific indexes for each category.