diff --git a/config/uberAgent-eventdata-filter-vastlimits.conf b/config/uberAgent-eventdata-filter-vastlimits.conf deleted file mode 100644 index 429228f5..00000000 --- a/config/uberAgent-eventdata-filter-vastlimits.conf +++ /dev/null @@ -1,11 +0,0 @@ -############################################################## -# -# Platform independent event data filtering -# -############################################################## - -[EventDataFilter] -# Limit the ProcCmdline field to 5000 for Splunk receivers. By default, Splunk truncates a single event to 10'000 (see: https://docs.splunk.com/Documentation/Splunk/latest/Data/Configureeventlinebreaking). -Action = defer -Sourcetype = Process:ProcessStartup -Query = Receiver.BackendType == 'Splunk' AND set(ProcCmdline, truncate(ProcCmdline, 5000, true)) diff --git a/config/uberAgent-eventdata-filter.conf b/config/uberAgent-eventdata-filter.conf index ed334aa9..c61ae3df 100644 --- a/config/uberAgent-eventdata-filter.conf +++ b/config/uberAgent-eventdata-filter.conf @@ -7,7 +7,6 @@ # vast limits event data filter @ConfigInclude uberAgent-eventdata-filter-vastlimits-Windows.conf platform=Windows @ConfigInclude uberAgent-eventdata-filter-vastlimits-macOS.conf platform=macOS -@ConfigInclude uberAgent-eventdata-filter-vastlimits.conf # vast limits DNS exclusions @ConfigInclude uberAgent-eventdata-filter-vastlimits-DNS.conf