topic Re: Forwarding and receiving no WinEventLog on Application, Security etc except Setup in Splunk Enterprise

Forwarding and receiving no WinEventLog on Application, Security etc except Setup

Kitteh — Fri, 22 Sep 2017 08:43:58 GMT

My forwarder's conf:

Input:
[default]
host = IE8Win7

[script://$SPLUNK_HOME\bin\scripts\splunk-wmi.path]
disabled = 0

[WinEventLog://Application]
disabled = 0

[WinEventLog://Security]
disabled = 0

[WinEventLog://System]
disabled = 0

Output:
[tcpout]
defaultGroup = default-autolb-group

[tcpout:default-autolb-group]
server = 192.168.0.1:9998

[tcpout-server://192.168.0.1:9998]

My receiver is set to listen on port 9998.
But in my Splunk Search & Reporting, it only shows WinEventLog:Setup in my Sourcetype and Source.

Re: Forwarding and receiving no WinEventLog on Application, Security etc except Setup

gcusello — Fri, 22 Sep 2017 09:45:26 GMT

Hi Kitteh,
download and install on your forwarders Splunk Add-on for Microsoft Windows ( https://splunkbase.splunk.com/app/742/ ), in this way you have a correct configuration of windows inputs.
Eventually disable some inputs that you don't need.
If it's a test, it's not important, if you have a production environment I suggest to use a Deployment server to deploy all TAs.
bye.
Giuseppe

Re: Forwarding and receiving no WinEventLog on Application, Security etc except Setup

Kitteh — Mon, 25 Sep 2017 03:02:32 GMT

Splunk Add-on for Microsoft Windows was already in the installer together. before the add-on, i've selected all kinds of Windows log as the input but to no avail not sent except setup windows log

Re: Forwarding and receiving no WinEventLog on Application, Security etc except Setup

gcusello — Tue, 29 Sep 2020 15:51:48 GMT

Hi Kitteh,
inputs.conf that you inserted in your question isn't the one in Windows TA, probably in is %SPLUNK_HOME/etc/system/local.
See in %SPLUNK_HOME/etc/apps/Splunk_TA_windows/default/inputs.conf and verify which stanzas are enabled (or eventually in %SPLUNK_HOME/etc/apps/Splunk_TA_windows/default/inputs.conf).
Or, if you have a Deployment server perform the same check in
%SPLUNK_HOME/etc/deploymentapps/Splunk_TA_windows/default/inputs.conf or in %SPLUNK_HOME/etc/apps/Splunk_TA_windows/default/inputs.conf.
Bye.
Giuseppe

Re: Forwarding and receiving no WinEventLog on Application, Security etc except Setup

Kitteh — Tue, 29 Sep 2020 15:55:23 GMT

Hi cusello

my file in %SPLUNK_HOME/etc/apps/Splunk_TA_windows/default/inputs.conf is currently like this in short:

[WinEventLog://Application]
disabled = 0
start_from = oldest
current_only = 0
checkpointInterval = 5
index = winapplication
renderXml=true

I've also created individual index for each logs like winsecurity, winsystem and winapplication. Is there anything gotta do with permissions in reading or transferring etc on the event viewer logs that i have to change, not sure if this is the issue.

Re: Forwarding and receiving no WinEventLog on Application, Security etc except Setup

gcusello — Mon, 25 Sep 2017 07:37:30 GMT

Check log policy and clock on target server.
Bye.
Giuseppe

Re: Forwarding and receiving no WinEventLog on Application, Security etc except Setup

Kitteh — Tue, 10 Oct 2017 09:23:28 GMT

Issue was solved, found out that Audit Policy in your gpedit.msc should be configured to enable auditing success and failure in Local Policies of the Computer.