Getting Data In

disable all inputs

sassens1
Path Finder

Hello,

I'd like to disable all the input on the Splunk_TA_microsoft_ad, is there a handy way to do this?
for example a local inputs.conf with

[perfmon:*]
disabled = 1

[powershell:*]
disabled = 1

[script:]
disabled = 1

[WinEventLog:]
disabled = 1

will do the trick?

Tags (2)
0 Karma
1 Solution

ckunath
Communicator

Hi sassens,

if the stanzas are predefined by the app and disabled is 0 on default, changing them to 1 will do the trick.

View solution in original post

0 Karma

ckunath
Communicator

Hi sassens,

if the stanzas are predefined by the app and disabled is 0 on default, changing them to 1 will do the trick.

0 Karma

sassens1
Path Finder

Hi,

ok regarding the stanzas they are more like
[WinEventLog://Directory Service]
[powershell://AD-Health]
and so on.

I'm not sure about the * and I don't have any server to test so if you can confirm the syntax?
thanks

0 Karma

ckunath
Communicator

The correct syntax in that regard would be
[WinEventLog://*]

Don't forget the two forward-slashes before putting the asteriks for all

0 Karma
Get Updates on the Splunk Community!

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

Splunk Up Your Game: Why It's Time to Embrace Python 3.9+ and OpenSSL 3.0

Did you know that for Splunk Enterprise 9.4, Python 3.9 is the default interpreter? This shift is not just a ...