Activity Feed
- Got Karma for Re: Remove Universal Forwarder default monitoring sources. 06-05-2020 12:46 AM
- Posted Re: Remove Universal Forwarder default monitoring sources on Getting Data In. 02-14-2014 08:14 AM
- Posted Remove Universal Forwarder default monitoring sources on Getting Data In. 02-14-2014 05:04 AM
- Tagged Remove Universal Forwarder default monitoring sources on Getting Data In. 02-14-2014 05:04 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 |
02-14-2014
08:14 AM
1 Karma
Wow, that was exactly what I needed. It took me a minute to figure out that I need to run that at an admin command prompt, though. The event log monitors were defined in:
\etc\apps\Splunk_TA_windows\default\inputs.conf
Now that I see the TA folder, I understand that it's the Windows Technology Add-On, and it all makes a lot more sense. Thanks you!
... View more
02-14-2014
05:04 AM
I've just installed the Universal Forwarder on Windows using the MSI. During installation, I told it to only monitor one folder of logs. It did that, and it's monitoring all of the windows events, too. That's causing me to exceed my license. I would like to turn off all of the default logging sources, except for the one I selected.
Reading everything I can find, I would expect that those would be listed in the Forwarder's inputs.conf, but there's nothing in there for my folder or for the Windows events. So, where are the settings that I entered using the MSI? And, how do I change them? And, how do I dial down the forwarding to just the one folder that I want?
... View more
- Tags:
- universal-forwarder
