filter windows application event by Source


I am using windows TA app to get events from windows event log.
The windows events are coming inside Indexer.

But i would like to filter them at universal forwarder if possible and get events for a particular source only - and not for all Applications - looking for specific values under "Source"

Source tells me that event is coming from which Application. So i want events only from Source=A and Source=B from windows application event log

Tags (1)
0 Karma

Revered Legend

See the link below with similar requirement (except that this post is filtering based on EventCode)

Also, note the fact that this changes have to be done on Indexer as you're using Universal Forwarder.

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes and swag!