Reporting

What .conf files do I change (path?) to add new windows event codes to like 4726 and so on?

SamHTexas
Contributor

What .conf files do I change (path?) to add new windows event codes to like 4726 and so on? What Splunk sever is this done on?

Labels (1)
Tags (1)
0 Karma

tscroggins
Builder

@SamHTexas 

Event log filters are defined in inputs.conf and copied to any instance of Splunk running on Windows, typically in %ProgramFiles%\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows\local when Splunk Add-on for Microsoft Windows is used. See https://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf#Event_Log_filtering.

0 Karma

SamHTexas
Contributor

Thank u. Which Splunk server do this on please?

Tags (1)
0 Karma