C:\Users: {}
C:\Windows:
  mask:
    - Write
    - Delete
    - DeleteSubdirectoriesAndFiles
    - ChangePermissions
    - TakeOwnership
  exclude:
    - C:\Windows\System32
C:\temp: {}
win_notify_interval: 30 # MUST be the same as interval in pillar config

C:\Users: {}
C:\Windows:
  mask:
    - Write
    - Delete
    - DeleteSubdirectoriesAndFiles
    - ChangePermissions
    - TakeOwnership
  exclude:
    - C:\Windows\System32
C:\temp: {}
win_notify_interval: 30 # MUST be the same as interval in pillar config
return: splunk_pulsar_return
batch: True

Add returner to windows pulsar file
Add returner to windows pulsar file