filter windows application event by Source

[ajaysamantbms]

I am using windows TA app to get events from windows event log.
The windows events are coming inside Indexer.

But i would like to filter them at universal forwarder if possible and get events for a particular source only - and not for all Applications - looking for specific values under "Source"

Source tells me that event is coming from which Application. So i want events only from Source=A and Source=B from windows application event log

[somesoni2]

See the link below with similar requirement (except that this post is filtering based on EventCode)

http://answers.splunk.com/answers/47168/windows-event-log-filter-attempt-failing

Also, note the fact that this changes have to be done on Indexer as you're using Universal Forwarder.