Onboard Windows event log based on source name

jasonlow · ‎05-29-2019

Hi. How would I ingest Windows Application events from a specific source name (and drop everything else)? For instance, ingest events with source MSSQLSERVER into the mssql index; source MSIINSTALLER into the msi index. It would be done with regex in transforms.conf, right?

richgalloway · ‎05-30-2019

Specify the index name in inputs.conf.

---
If this reply helps you, Karma would be appreciated.

Onboard Windows event log based on source name

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Agentic Operations Start with Context: Build the Right Data Foundation

Assisted, Augmented or Agentic? Choose Your Splunk Starting Point

Session 2 | Beyond the Thread: Operationalizing AI with Confidence

Join the Conversation

Onboard Windows event log based on source name

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Agentic Operations Start with Context: Build the Right Data Foundation

Assisted, Augmented or Agentic? Choose Your Splunk Starting Point

Session 2 | Beyond the Thread: Operationalizing AI with Confidence