You can configure this when you install the forwarder on the remote machine. There is a setting GUI during the install that allows you to select which event logs to monitor.
Settings for monitoring the event logs can be found in on the forwarder in the splunk\etc\apps*\local\inputs.conf files. Some will be turned on, and others will be turned off. You can turn them on or off by changing the "disabled" parameter value to 1 (off) or 0 (on). If you make changes to inputs.conf you will need to restart the splunkd service on the forwarder for the changes to take affect.
