Universal Forwarder- Duplicate logs

[Bill_B]

I have a Universal Forwarder on Win2008R2. The forwarder is reading Windows logs from a local file and forwarding to Splunk Enterprise. During setup, when prompted for what files to forward and the file path to read from, I selected "Security Logs" and "Forwarded Logs". Unfortunately the forwarder is now reading one event log and forwarding it as two logs; 1 labeled security logs and the other forwarded logs.

My Question is: What file do I need to change to get rid of either "Security Logs" or "Forwarded Logs"? (For example, I looked in $SPLUNK_HOME/etc/system/local/... inputs.conf and outputs.conf but I did not find the configuration in either location.)

Thank you.

[Bill_B]

To solve this:

Modify file-
C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows\local\inputs.conf

All types of logs you don't want as a source should be edited to: "disable = 1"

The above file path is for a default install of Universal Forwarder on Windows2008R2.

[lukejadamec]

On the Splunk indexer, stop the remote inputs for the host.

Remote inputs are from wmi(configured on the indexer), local inputs are local(configured on the forwarder). They are both the same log file(s).

[lukejadamec]

I should have mentioned that you can confirm the duplicates are from using both local and remote sources by looking at the sources. WMI sources will contain 'WMI' in the name, and local ones won't.

[lukejadamec]

I think that depends on how they were configured. You will find them in the /etc/apps/someapp/local/wmi.conf file.

[Bill_B]

What is the default location for remote inputs?
-Thanks