I am using windows TA app to get events from windows event log.
The windows events are coming inside Indexer.
But i would like to filter them at universal forwarder if possible and get events for a particular source only - and not for all Applications - looking for specific values under "Source"
Source tells me that event is coming from which Application. So i want events only from Source=A and Source=B from windows application event log
See the link below with similar requirement (except that this post is filtering based on EventCode)
Also, note the fact that this changes have to be done on Indexer as you're using Universal Forwarder.