Onboard Windows event log based on source name

jasonlow · ‎05-29-2019

Hi. How would I ingest Windows Application events from a specific source name (and drop everything else)? For instance, ingest events with source MSSQLSERVER into the mssql index; source MSIINSTALLER into the msi index. It would be done with regex in transforms.conf, right?

richgalloway · ‎05-30-2019

Specify the index name in inputs.conf.

---
If this reply helps you, Karma would be appreciated.

Onboard Windows event log based on source name

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

Your summer travels continue with new course releases

Are you a member of the Splunk Community?

Onboard Windows event log based on source name

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

Your summer travels continue with new course releases