How to collect citrix events for splunk enterprise?

[dbiguene]

Hello everyone
I work in a citrix service and i need to collect all the citrix events with a forwarder.
My forwarder is in a citrix server and my indexer in another VM, i configure input.cong (forwarder side) to collect the events from Application with this line :
[WinEventLog://Application] and that works but i want only the citrix events, i can see the events with EventViewer, their is a "source" field in Application so is it possible to collect all the events from citrix sources like Citrix File Management ?
Something like :
[WinEventLog://Application]
source = Citrix File Management
(i tried it doesn't work)
If not, another way to do that?

Thanks

[somesoni2]

You'd need to set whitelist on your inputs.conf to setup your custom filter. See this link for how to do that and all available field names that you need to set (you'd need to use SourceName instead of just source in your whitelist)

http://docs.splunk.com/Documentation/Splunk/7.1.2/Data/MonitorWindowseventlogdata#Create_advanced_fi...