Splunk Add-on for Microsoft Windows: How do I limit indexed data by service Name or DisplayName?

[corey_reynders]

sourcetype=WinHostMon
source=service

How do I only index data for specific Name or DisplayName values of these events?

I don't want data for all of the services, just for the ones that fit masks that I apply. For perfmon collectors you can do it with instances = in inputs.conf but how do I do the same for WinHostMon?

[corey_reynders · Accepted solution]

Ended up having to do it with props / transforms.conf

$SPLUNK_HOME/etc/system/local/props.conf (indexer and heavy forwarders)
[source::service]
sourcetype = WinHostMon
TRANSFORMS-limit-winhostmon-service = winhostmon-service-setnull, winhostmon-service-keep

$SPLUNK_HOME/etc/system/local/transforms.conf (indexer and heavy forwarders)
[winhostmon-service-setnull]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue

[winhostmon-service-keep]
REGEX = (?i)name=".*(name1|name2|name3)
DEST_KEY = queue
FORMAT = indexQueue

Can't do it with instances=(regex) or blacklist/whitelist. Oh well.

[aaraneta_splunk]

Hi @corey_reynders - Glad to hear that you were able to figure out the answer yourself. Please don't forget to resolve this post by clicking "Accept" below your answer (and give yourself some karma points :D). Thanks!

[corey_reynders]

I could still use some advice if anyone has any. I figured this would be a common task. Mayhaps I misjudged the scenario.