topic Re: Splunk App for Windows Infrastructure: Why are WinEventLog configurations not indexing any data? in All Apps and Add-ons

Splunk App for Windows Infrastructure: Why are WinEventLog configurations not indexing any data?

amithhegde — Wed, 12 Aug 2015 11:56:55 GMT

I have the Windows Infrastructure app installed on a Windows machine. The monitor stanza and the powershell scripts are working fine, but the Winevent logs with the following config are not indexing any data.

[WinEventLog:DFS Replication]
 disabled=0
 sourcetype="WinEventLog:DFS Replication"
 index=winevents
 queue=parsingQueue

 # Application and Services Logs - Directory Service

 [WinEventLog:Directory Service]
 disabled=0
 sourcetype="WinEventLog:Directory Service"
 index=winevents
 queue=parsingQueue

 # Application and Services Logs - File Replication Service

 [WinEventLog:File Replication Service]
 disabled=0
 sourcetype="WinEventLog:File Replication Service"
 index=winevents
 queue=parsingQueue

Please guide me where am I going wrong?

Re: Splunk App for Windows Infrastructure: Why are WinEventLog configurations not indexing any data?

Richfez — Thu, 13 Aug 2015 21:12:11 GMT

Two semi-general suggestions:

If it's installed on the local machine, is that local machine a Domain Controller?

You do have a "winevents" index on the indexer this gets sent to, right? If not, create that. I believe I had a problem where that app didn't create one of the indexes, though I don't recall which one. This could be your problem.

Re: Splunk App for Windows Infrastructure: Why are WinEventLog configurations not indexing any data?

amithhegde — Fri, 14 Aug 2015 13:55:56 GMT

Hi Rich,

Thanks for replyin, yes I have the "winevents" index created, and the machine I want to gt events from is not a local machine. But i have deployed the DomainController App on the machine in question.

Kindly let me know if I am missing something. Any suggestions on this would be really helpful.

Re: Splunk App for Windows Infrastructure: Why are WinEventLog configurations not indexing any data?

Richfez — Fri, 14 Aug 2015 15:10:39 GMT

Well, something I noticed and I have no idea if it's a problem or not, but all my DCs have their various sourcetypes set with no spaces in it.

For instance, on the one I checked, C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-DomainController-NT6\default\inputs.conf says:

[WinEventLog://File Replication Service]
disabled=0
sourcetype=WinEventLog:File-Replication-Service
index=wineventlog
queue=parsingQueue

Try changing them to dashes and not spaces in those stanza and restart the UF?