Why is one Microsoft Windows Security event shows up as thousands of events?

[mjkenney]

Started forwarding two specific IAS Security events to Splunk. My inputs.conf stanza on the Universal Forwarder is below. However, in Splunk, one event shows up as 1,047 events over and over again. Is my stanza wrong, or is there something else going on here?

[WinEventLog://Security]
disabled = 0
start_from = newest
current_only = 0
index = radius
whitelist = 6272,6273

[mjkenney · Accepted solution]

Well I removed "start_from" and changed current_only from 0 to 1. That fixed it.

[woodcock]

I would open support case for sure.