Archive

filter windows application event by Source

Explorer

I am using windows TA app to get events from windows event log.
The windows events are coming inside Indexer.

But i would like to filter them at universal forwarder if possible and get events for a particular source only - and not for all Applications - looking for specific values under "Source"

Source tells me that event is coming from which Application. So i want events only from Source=A and Source=B from windows application event log

Tags (1)
0 Karma

Revered Legend

See the link below with similar requirement (except that this post is filtering based on EventCode)

http://answers.splunk.com/answers/47168/windows-event-log-filter-attempt-failing

Also, note the fact that this changes have to be done on Indexer as you're using Universal Forwarder.

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes and swag!