Getting Data In
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
Ask a Question
Highlighted

Onboard Windows event log based on source name

jasonlow
Loves-to-Learn
‎05-29-2019 02:51 PM

Hi. How would I ingest Windows Application events from a specific source name (and drop everything else)? For instance, ingest events with source MSSQLSERVER into the mssql index; source MSIINSTALLER into the msi index. It would be done with regex in transforms.conf, right?

0 Karma
Reply
Highlighted

Re: Onboard Windows event log based on source name

richgalloway
SplunkTrust
SplunkTrust
‎05-30-2019 06:09 AM

Specify the index name in inputs.conf.

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Reply