From 25174fc641854e694cc912c56e3d7da1fe020d25 Mon Sep 17 00:00:00 2001
From: Chris Long <clong@cl0ng.com>
Date: Fri, 29 Dec 2017 07:36:38 +0700
Subject: [PATCH] Remove extraneous config stanza from WEF inputs

---
 Vagrant/resources/splunk_forwarder/wef_inputs.conf | 12 ------------
 1 file changed, 12 deletions(-)

diff --git a/Vagrant/resources/splunk_forwarder/wef_inputs.conf b/Vagrant/resources/splunk_forwarder/wef_inputs.conf
index de44d42..8673674 100755
--- a/Vagrant/resources/splunk_forwarder/wef_inputs.conf
+++ b/Vagrant/resources/splunk_forwarder/wef_inputs.conf
@@ -1,15 +1,3 @@
-[default]
-evt_resolve_ad_obj = 1
-evt_dc_name = ldaps.ad.ha.palantir
-evt_dns_name = ldaps.ad.ha.palantir
-evt_ad_cache_disabled = 0
-evt_ad_cache_max_entries = 40000
-evt_ad_cache_exp_neg = 10
-evt_sid_cache_disabled = 0
-evt_sid_cache_max_entries = 40000
-evt_sid_cache_exp_neg = 1000
-batch_size = 500
-
 [WinEventLog://ForwardedEvents]
 sourcetype = WinEventLog:ForwardedEvents
 index=wineventlog