Can Universal Forwaders filter in their input.conf file?

[splunktrainingu]

I am attempting to filter an eventID 5156 with an application name of "\device\harddiskvolume5\program files\bonjour\mdnsresponder.exe" I am using a Universal Forwarder but I am seeing mixed responses saying this is not possible on universal Forwarder. My Universal Forwarders point to my Indexer.

[dsctm3 · Accepted solution]

Check this out.

https://www.splunk.com/en_us/blog/tips-and-tricks/controlling-4662-messages-in-the-windows-security-...

I think this is along the line of what you are looking for. You need to use regex to create the filter.

(Edit: Formatting)