I'm getting lots of data back from forwarders that are for Event ID's not listed in my Inputs.conf whitelist. Why? It's about 30% of my returned data and now I'm getting data I don't want and it's taking up part of my data license on top of it. Is there a default list of Event ID's that just come in anyway?
↧
