Disable Windows application Events and allow only ... - Splunk Community

Getting Data In

Hi All,

Can anyone advise me on below

I have Windows Application logs disabled already but I need one event ID that should be allowed.

you can give whitelist attribute in monitoring stanza for application events -

For ref - https://docs.splunk.com/Documentation/SplunkCloud/8.2.2106/Data/MonitorWindowseventlogdata

Get Updates on the Splunk Community!

How to Monitor AI Agents with Splunk Agent Observability

Let’s say I’m running a travel planning AI app in production. A user asks for three concise hotel options in ...

Deep Dive: The Agentic SOC in Action with Enterprise Security Agents

Takeaways: Splunk Enterprise Security brings Agentic SOC capabilities into the analyst workflow. Agents ...

[Puzzles] Solve, Learn, Reuse: Word-play

This puzzle series (first published here) is based on analysing words.Some of the statements in your puzzle ...