Filtering of Windows Event using whitelist = << list >> or blacklist = << list >>, does work on Universal Forwarder in 6.x. Also, in my environment using stanza like below does not cause the warning.
...\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows\local\inputs.conf [WinEventLog://Security]
...\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows\local\inputs.conf blacklist = 5156
...\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows\default\inputs.conf checkpointInterval = 5
...\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows\default\inputs.conf current_only = 0
...\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows\local\inputs.conf disabled = 0
...\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows\default\inputs.conf evt_dc_name =
...\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows\default\inputs.conf evt_dns_name =
...\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows\default\inputs.conf evt_resolve_ad_obj = 1
...\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows\default\inputs.conf start_from = oldest
... View more
