How to only forward Windows Security logs

[sventura15]

Hi,

I would like to forward only successful and failed Windows login attempts from my Windows 2008 Server to my RHEL forwarder. How do I go about configuring this?

My thanks in advance

[sventura15]

another question, this props and transforms file, are they supposed to be edited in the default directory (C:\Program Files\Splunk\etc\system\default), or are the files supposed to be moved to the C:\Program Files\Splunk\etc\system\local and then edited ?

[sventura15]

after doing this, and restarting splunk, is there anything else I have to do or just look for logs to show up on the receiveing end ?

Thanks