We have deployed the splunk client to all of our windows servers (a lot of them) One thing we see constantly is "SourceName=Microsoft-Windows-TerminalServices-Printers". (Its a none issue error)
Is it possible to get splunk to ignore those and not report on them?
You can send those events to the null queue so they won't be in Splunk. Good example in the docs and included a link to a previous answer on splunkbase for this topic.
http://splunk-base.splunk.com/answers/11617/route-unwanted-logs-to-a-null-queue
I will check that out.....Thank you