Getting Data In

disable all inputs

sassens1
Path Finder

Hello,

I'd like to disable all the input on the Splunk_TA_microsoft_ad, is there a handy way to do this?
for example a local inputs.conf with

[perfmon:*]
disabled = 1

[powershell:*]
disabled = 1

[script:]
disabled = 1

[WinEventLog:]
disabled = 1

will do the trick?

Tags (2)
0 Karma
1 Solution

ckunath
Communicator

Hi sassens,

if the stanzas are predefined by the app and disabled is 0 on default, changing them to 1 will do the trick.

View solution in original post

0 Karma

ckunath
Communicator

Hi sassens,

if the stanzas are predefined by the app and disabled is 0 on default, changing them to 1 will do the trick.

View solution in original post

0 Karma

sassens1
Path Finder

Hi,

ok regarding the stanzas they are more like
[WinEventLog://Directory Service]
[powershell://AD-Health]
and so on.

I'm not sure about the * and I don't have any server to test so if you can confirm the syntax?
thanks

0 Karma

ckunath
Communicator

The correct syntax in that regard would be
[WinEventLog://*]

Don't forget the two forward-slashes before putting the asteriks for all

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!