I have 3 servers which process web service calls and are being indexed by Splunk. I specified their index in the inputs.conf on the forwarder as index=uvtrans
and their sourcetype is ATG_Message_Log
.. So now I see in Splunk 2 different sources coming in named WinEventLog.Application
and WinEventLog.System
which are in index=main
which means their index was not specified on the forwarder so it defaults there. I'm looking in Splunk_Home/etc/system/local/inputs.conf on all 3 boxes and I do not see anywhere where WinEventLog
is located. I've looked through all the conf files and cannot find it.
Does Splunk index EVERYTHING on that server regardless if it's been specified in my conf files? How can I exclude the WinEventLog
sources from being indexed by Splunk?
Looks like you might have the Windows TA installed, it collects data with those sourcetypes
http://docs.splunk.com/Documentation/WindowsApp/4.7TA/User/AbouttheSplunkTechnologyAdd-on(TA)forWind...
Looks like you might have the Windows TA installed, it collects data with those sourcetypes
http://docs.splunk.com/Documentation/WindowsApp/4.7TA/User/AbouttheSplunkTechnologyAdd-on(TA)forWind...
If you are searching for lost configurations splunks btool can be helpful:
splunk cmd btool [conf file name] list --debug
In your case you would run
splunk cmd btool inputs list --debug
Hope it helps.
There can be other inputs.conf available under Splunk_HOme/etc/apps/AppNamesHere/ under local and default folder. Have a look there.