Getting Data In

Disable forwarding of Windows Event Logs

chrissale
Explorer

I am using a Universal Forwarder to collect events from a Windows server. In /etc/system/local I have created custom inputs.conf and outputs.conf to collect events from a log file and forward them on to an indexer. However, the indexer is also receiving events of the source type WinEventLog:Application, WinEventLog:System and WinEventLog:Security. How can I disable this?

1 Solution

Ayn
Legend

These are set in $SPLUNK_HOME\etc\apps\MSIcreated\default\inputs.conf. You could either change the values there so that these inputs are disabled, or override them by adding new stanzas in etc/system/local/inputs.conf where you disable the inputs.

View solution in original post

MuS
Legend

Hi chrissale,

either disable the Windows Add-on on the universal forwarder or setup route and filter on the indexer to filter out the unwanted events. The later must be done on the indexer and is only valid for new events coming in, because the raw data does not get parsed by the universal forwarder.

hope this helps ...

cheers, MuS

0 Karma

Ayn
Legend

These are set in $SPLUNK_HOME\etc\apps\MSIcreated\default\inputs.conf. You could either change the values there so that these inputs are disabled, or override them by adding new stanzas in etc/system/local/inputs.conf where you disable the inputs.

chrissale
Explorer

Hi Ayn, thanks for the quick response. I don't have $SPLUNK_HOME\etc\apps\MSIcreated. Never-the-less I added to following stanzas to $SPLUNK_HOME\etc\system\local\inputs.conf and that seems to have done the trick.

[WinEventLog://Application]
disabled = true
[WinEventLog://Security]
disabled = true
[WinEventLog://System]
disabled = true

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...