Getting Data In
Highlighted

Onboard Windows event log based on source name

Loves-to-Learn

Hi. How would I ingest Windows Application events from a specific source name (and drop everything else)? For instance, ingest events with source MSSQLSERVER into the mssql index; source MSIINSTALLER into the msi index. It would be done with regex in transforms.conf, right?

0 Karma
Highlighted

Re: Onboard Windows event log based on source name

SplunkTrust
SplunkTrust

Specify the index name in inputs.conf.

---
If this reply helps you, an upvote would be appreciated.
0 Karma