I'm trying to discover my source input.conf file that is responsible for pulling in the WinEventLogs.  Our original implementation was back in 2019, and completed by another SME that has since moved on.   When we implemented Splunk Cloud there was many other onsite components implemented, incuding an IDM server.  Since moving to the Victoria Experience we no longer utilize an IDM server, but have the rest of the resources in placed as shown in my attached..  That said, I'm just trying to confirm where to filter my oswin logs from, but not convinced I have identified the source.  While I found the inputs.conf file under Splunk_TA_windows (where I'd expect it to be) on the deployment server, I'm not confident it's responsible for this data input. This is because all my entries in the  stanza specific for WinEventLog ... has a disable = 1.  So while I want to believe, I cannot.  I've look over mulmore importantly where are my WinEventLogs truly being sourced from (which inputs.conf)?  I've review my resources on the Deployment Server, DMZ Forwarder and Syslog UFW Server  and not finding anything else that would be responsible, nor anything installed regarding Splunk_TA_windows, however I am indeed getting plenty of data, and trying to be more efficient with our ingest and looking to filter some of these type of logs out.  TIA    ... View more