This documentation does not apply to the most recent version of Splunk.
This documentation applies to the following versions of Splunk: 3.2 , 3.2.1 , 3.2.2 , 3.2.3 , 3.2.4 , 3.2.5 , 3.2.6
By default, the Splunk Windows port is configured to index your Windows Application, System, and Security event logs. This functionality is not yet exposed in Splunk Web or the CLI. To disable indexing for an event log, use # to comment it out in the following stanza in $SPLUNK_HOME/etc/bundles/local/inputs.conf:
# Windows platform specific input processor. [WinEventLog:Application] [WinEventLog:Security] [WinEventLog:System]
Note: You must use two backslashes \\ to escape wildcards in stanza names in inputs.conf. Regexes with backslashes in them are not currently supported when specifying paths to files.