I have 3 servers which process web service calls and are being indexed by Splunk. I specified their index in the inputs.conf on the forwarder as
index=uvtrans and their sourcetype is
ATG_Message_Log.. So now I see in Splunk 2 different sources coming in named
WinEventLog.Systemwhich are in
index=main which means their index was not specified on the forwarder so it defaults there. I'm looking in Splunk_Home/etc/system/local/inputs.conf on all 3 boxes and I do not see anywhere where
WinEventLog is located. I've looked through all the conf files and cannot find it.
Does Splunk index EVERYTHING on that server regardless if it's been specified in my conf files? How can I exclude the
WinEventLog sources from being indexed by Splunk?
If you are searching for lost configurations splunks btool can be helpful:
splunk cmd btool [conf file name] list --debug
In your case you would run
splunk cmd btool inputs list --debug
Hope it helps.