https://community.splunk.com/t5/Splunk-Enterprise/Correct-format-for-inputs-conf-stanza/m-p/682182#M18987 <P>Are those logs deliberately put in a file, or can they be viewed in the Windows Event Log?</P><P>If they are in the Windows Event Logs, then you can use a WinEventLog stanza:</P><LI-CODE lang="markup">[WinEventLog://Microsoft-Windows-DriverFrameworks-UserMode/Operational] index=&lt;your index&gt; sourcetype=&lt;your sourcetype&gt; #etc</LI-CODE><P>&nbsp;ref:&nbsp;<A href="https://docs.splunk.com/Documentation/Splunk/9.2.0/admin/Inputsconf" target="_blank">https://docs.splunk.com/Documentation/Splunk/9.2.0/admin/Inputsconf</A></P> Wed, 27 Mar 2024 20:07:41 GMT marnall 2024-03-27T20:07:41Z https://community.splunk.com/t5/Splunk-Enterprise/Correct-format-for-inputs-conf-stanza/m-p/682179#M18985 <P>I want to add C:\windows\system32\winevt\logs\Microsoft-Windows-DriverFrameworks-UserMode/Operational&nbsp; as a stanza in my inputs.conf.</P><P>How do I write the stanza?</P><P>Thank you</P> Wed, 27 Mar 2024 20:01:01 GMT https://community.splunk.com/t5/Splunk-Enterprise/Correct-format-for-inputs-conf-stanza/m-p/682179#M18985 sswigart 2024-03-27T20:01:01Z https://community.splunk.com/t5/Splunk-Enterprise/Correct-format-for-inputs-conf-stanza/m-p/682182#M18987 <P>Are those logs deliberately put in a file, or can they be viewed in the Windows Event Log?</P><P>If they are in the Windows Event Logs, then you can use a WinEventLog stanza:</P><LI-CODE lang="markup">[WinEventLog://Microsoft-Windows-DriverFrameworks-UserMode/Operational] index=&lt;your index&gt; sourcetype=&lt;your sourcetype&gt; #etc</LI-CODE><P>&nbsp;ref:&nbsp;<A href="https://docs.splunk.com/Documentation/Splunk/9.2.0/admin/Inputsconf" target="_blank">https://docs.splunk.com/Documentation/Splunk/9.2.0/admin/Inputsconf</A></P> Wed, 27 Mar 2024 20:07:41 GMT https://community.splunk.com/t5/Splunk-Enterprise/Correct-format-for-inputs-conf-stanza/m-p/682182#M18987 marnall 2024-03-27T20:07:41Z https://community.splunk.com/t5/Splunk-Enterprise/Correct-format-for-inputs-conf-stanza/m-p/682186#M18988 <P>Thank you!</P> Wed, 27 Mar 2024 20:45:14 GMT https://community.splunk.com/t5/Splunk-Enterprise/Correct-format-for-inputs-conf-stanza/m-p/682186#M18988 sswigart 2024-03-27T20:45:14Z