Onboard Windows event log based on source name

jasonlow · ‎05-29-2019

Hi. How would I ingest Windows Application events from a specific source name (and drop everything else)? For instance, ingest events with source MSSQLSERVER into the mssql index; source MSIINSTALLER into the msi index. It would be done with regex in transforms.conf, right?

richgalloway · ‎05-30-2019

Specify the index name in inputs.conf.

---
If this reply helps you, Karma would be appreciated.

Onboard Windows event log based on source name

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Make your Splunk investment work harder with Optimization Advisor

How Splunk AI Assistant Is Transforming Investigations: Insights from .conf26

Make Your Machine Data AI-Ready in Splunk

Join the Conversation

Onboard Windows event log based on source name

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Make your Splunk investment work harder with Optimization Advisor

How Splunk AI Assistant Is Transforming Investigations: Insights from .conf26

Make Your Machine Data AI-Ready in Splunk