Hi Team, From Windows Event Viewer logs we can onboard all Event ID's generated for "Application" and "System" Event logs but unable to onboard filtered events based on Event Code OR Type(Error/Warning).   Below is inputs.conf written by me to filter-out the events which is not working.Also followed the below splunk docs.   [WinEventLog ://Application] disabled = 0 whitelist = Type="^[Error|Critical]" index = test   OR   [WinEventLog://Application] disabled = 0 whitelist = EventCode="1001|11707" index = test     [WinEventLog://System] disabled = 0 whitelist 1 = Event Code=7011 whitelist 2 = Type="^[Error|Critical]" index = test   https://community.splunk.com/t5/Getting-Data-In/Monitor-Windows-Event-Log-for-Critical-Error/td-p/502991 https://docs.splunk.com/Documentation/SplunkCloud/8.0.2006/Data/MonitorWindowseventlogdata   Please check with your seniors on How can we whitelist only Error events in Application or System Event logs. Please find the attachement       ... View more