Does Splunk Index Everything on the Server?

[skoelpin]

I have 3 servers which process web service calls and are being indexed by Splunk. I specified their index in the inputs.conf on the forwarder as index=uvtrans and their sourcetype is ATG_Message_Log.. So now I see in Splunk 2 different sources coming in named WinEventLog.Application and WinEventLog.Systemwhich are in index=main which means their index was not specified on the forwarder so it defaults there. I'm looking in Splunk_Home/etc/system/local/inputs.conf on all 3 boxes and I do not see anywhere where WinEventLog is located. I've looked through all the conf files and cannot find it.

Does Splunk index EVERYTHING on that server regardless if it's been specified in my conf files? How can I exclude the WinEventLog sources from being indexed by Splunk?

[pwmcity · Accepted solution]

Looks like you might have the Windows TA installed, it collects data with those sourcetypes
http://docs.splunk.com/Documentation/WindowsApp/4.7TA/User/AbouttheSplunkTechnologyAdd-on(TA)forWind...

[hgrow]

If you are searching for lost configurations splunks btool can be helpful:

splunk cmd btool [conf file name] list --debug

In your case you would run

splunk cmd btool inputs list --debug

Hope it helps.

[somesoni2]

There can be other inputs.conf available under Splunk_HOme/etc/apps/AppNamesHere/ under local and default folder. Have a look there.