https://community.splunk.com/t5/Splunk-Dev/Splunking-Windows-2K8R2-Application-and-Service-Logs/m-p/21182#M222 <P>Hi.<BR /><BR /> I am able to successfully Splunk Windows Security Event logs. I am have a challenge configuring my inputs.conf file to send data logged in %SystemRoot%\System32\Winevt\Logs\Microsoft-IIS-Configuration%4Operational.evtx. These events appear in the event viewer - Applications and Service Logs - Microsoft - Windows - IIS-Configuration</P> <P>Any direction would be great.</P> Wed, 01 May 2013 16:45:24 GMT kevind5 2013-05-01T16:45:24Z https://community.splunk.com/t5/Splunk-Dev/Splunking-Windows-2K8R2-Application-and-Service-Logs/m-p/21182#M222 <P>Hi.<BR /><BR /> I am able to successfully Splunk Windows Security Event logs. I am have a challenge configuring my inputs.conf file to send data logged in %SystemRoot%\System32\Winevt\Logs\Microsoft-IIS-Configuration%4Operational.evtx. These events appear in the event viewer - Applications and Service Logs - Microsoft - Windows - IIS-Configuration</P> <P>Any direction would be great.</P> Wed, 01 May 2013 16:45:24 GMT https://community.splunk.com/t5/Splunk-Dev/Splunking-Windows-2K8R2-Application-and-Service-Logs/m-p/21182#M222 kevind5 2013-05-01T16:45:24Z https://community.splunk.com/t5/Splunk-Dev/Splunking-Windows-2K8R2-Application-and-Service-Logs/m-p/21183#M223 <P>If your logs channels exists in the eventviewer, you can add them in splunk using the same name.</P> <P>Here is the method <A href="http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/MonitorWindowsdata#Event_log_monitor_configuration_values">http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/MonitorWindowsdata#Event_log_monitor_configuration_values</A></P> Fri, 03 May 2013 15:45:33 GMT https://community.splunk.com/t5/Splunk-Dev/Splunking-Windows-2K8R2-Application-and-Service-Logs/m-p/21183#M223 yannK 2013-05-03T15:45:33Z