Onboard Windows event log based on source name

jasonlow · ‎05-29-2019

Hi. How would I ingest Windows Application events from a specific source name (and drop everything else)? For instance, ingest events with source MSSQLSERVER into the mssql index; source MSIINSTALLER into the msi index. It would be done with regex in transforms.conf, right?

richgalloway · ‎05-30-2019

Specify the index name in inputs.conf.

---
If this reply helps you, Karma would be appreciated.

Onboard Windows event log based on source name

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

Splunk Community Badges!

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

Join the Conversation

Onboard Windows event log based on source name

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

Splunk Community Badges!

[Puzzles] Solve, Learn, Repeat: Matching cron expressions