I have installed the required apps to get Splunk App for Windows Infrastructure to work. I have the inputs.conf configured with the following:  ###### OS Logs ###### [WinEventLog://Application] disabled = 0 index = wineventlog start_from = oldest current_only = 0 checkpointInterval = 5 renderXml=true [WinEventLog://Security] disabled = 0 index = wineventlog start_from = oldest current_only = 0 evt_resolve_ad_obj = 1 checkpointInterval = 5 blacklist1 = EventCode="4662" Message="Object Type:(?!\s*groupPolicyContainer)" blacklist2 = EventCode="566" Message="Object Type:(?!\s*groupPolicyContainer)" renderXml=true [WinEventLog://System] disabled = 0 index = wineventlog start_from = oldest current_only = 0 checkpointInterval = 5 renderXml=true   If i search for the index wineventlog i see items that have been indexed from all desktops, but for some reason i cant seem  to get the information to show up on the Splunk App for Windows Infrastructure under Windows > Event Monitoring all i get is No Results found....    Any ideas why this would be?  I have tried to run the Build lookups again etc and its the same.  Thanks ... View more

Hi there  New here to using Splunk, we are looking to use Splunk Universal Forwarder to forward windows event logs to a splunk server.  I have installed the forwarder on a win10 client and i can see events coming into Splunk which is great!  Is there any way that i can tweek the Universal Forwarder on the client PC to not forward some events such as Information logs, Audit Success, and possibly stop forwarding all the text from the event such as the description and all that?   Trying to be as lean as possible with these events really.    Thanks ... View more