I am trying to filter events, and am not having any luck.
Log info in Splunk:
SourceName=Microsoft-Windows-Service Control Manager
TaskCategory=The operation completed successfully.
OpCode=The operation completed successfully.
Message=The WMI Performance Adapter service entered the stopped state.
these files have been changed on the machine that forwards the data.
what am i missing?
You can't do this on a universal forwarder. It needs to happen where the data is parsed, which is either at the indexer or the heavy forwarder acting as an intermediate forwarder.
There are not any ways to further limit which system events are sent. You could remove the system events completely, but if you only want to have certain system events, those have to be thrown out at the indexer.
i saw that after looking for a different way to do this. the problem is we want to limit what gets sent to the indexer because of the bandwidth usage. changing forwarders would not be an option as we have 800+ clients forwarding data. are there any other ways to limit what is sent?