Windows event server Logs on Splunk. I only want to see critical logs being reported

[jboike]

We have a windows event server registered with Splunk, and want to know, is it possible to rate the the logs - critical to low, and if so, how is that done? Because I don't want all the logs being seen, I only want critical logs showing on the windows event server to save space.

[rphillips_splk]

see the section Create advanced filters with 'whitelist' and 'blacklist' in http://docs.splunk.com/Documentation/Splunk/6.2.6/Data/MonitorWindowsdata for details