Getting Data In

How to drop logs from crowdtrike using transform.conf

rtalcik
Path Finder

Hi All,

So first I want to apologize if I don't understand much as I am fairly new to the administration side.

However, I read some documentation that I can use transform.conf to drop logs from coming into splunk.

I am using a universal forwarder and I want a specific powershell script whitelisted.

Can anyone send me a documentation on how I would edit transform.conf to whitelist a specific powershell script? If there is a better way, that would work too.

0 Karma
1 Solution

to4kawa
Ultra Champion
0 Karma

to4kawa
Ultra Champion
0 Karma

rtalcik
Path Finder

you wanna post this as a question so I can accept it

0 Karma

to4kawa
Ultra Champion

roger that!

0 Karma
Get Updates on the Splunk Community!

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

What's New in Splunk Observability Cloud and Splunk AppDynamics - May 2025

This month, we’re delivering several new innovations in Splunk Observability Cloud and Splunk AppDynamics ...

Getting Started with Splunk Artificial Intelligence, Insights for Nonprofits, and ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...