https://community.splunk.com/t5/Splunk-Dev/How-to-set-inputs-file-for-collect-WinEventLog-for-File/m-p/340837#M5207 <P>It's AD server (Windows 2012 Enterprise).</P> Tue, 13 Mar 2018 14:47:38 GMT otis_huang 2018-03-13T14:47:38Z https://community.splunk.com/t5/Splunk-Dev/How-to-set-inputs-file-for-collect-WinEventLog-for-File/m-p/340835#M5205 <P>Dears,</P> <P>How to set inputs file for collect WinEventLog for File Replication Service?<BR /> I try to add two kind of stanza in splunkforwarder file "$SPLUNK_HOME/etc/system/local/inputs.conf" as below:<BR /> But It doesn't work. Please help.</P> <H2>stanza: </H2> <P>[WinEventLog:File Replication Service]<BR /> disabled=0<BR /> sourcetype="WinEventLog:File Replication Service"<BR /> index=windows</P> <P>or </P> <P>[WinEventLog://File Replication Service]<BR /> disabled = 0</P> Tue, 13 Mar 2018 12:28:37 GMT https://community.splunk.com/t5/Splunk-Dev/How-to-set-inputs-file-for-collect-WinEventLog-for-File/m-p/340835#M5205 otis_huang 2018-03-13T12:28:37Z https://community.splunk.com/t5/Splunk-Dev/How-to-set-inputs-file-for-collect-WinEventLog-for-File/m-p/340836#M5206 <P>Which windows version you are using?</P> Tue, 13 Mar 2018 13:30:03 GMT https://community.splunk.com/t5/Splunk-Dev/How-to-set-inputs-file-for-collect-WinEventLog-for-File/m-p/340836#M5206 p_gurav 2018-03-13T13:30:03Z https://community.splunk.com/t5/Splunk-Dev/How-to-set-inputs-file-for-collect-WinEventLog-for-File/m-p/340837#M5207 <P>It's AD server (Windows 2012 Enterprise).</P> Tue, 13 Mar 2018 14:47:38 GMT https://community.splunk.com/t5/Splunk-Dev/How-to-set-inputs-file-for-collect-WinEventLog-for-File/m-p/340837#M5207 otis_huang 2018-03-13T14:47:38Z https://community.splunk.com/t5/Splunk-Dev/How-to-set-inputs-file-for-collect-WinEventLog-for-File/m-p/340838#M5208 <P>Hi otis_huang,</P> <P>You can refer this doc below:<BR /> <A href="https://docs.splunk.com/Documentation/ActiveDirectory/1.2.2/DeployAD/Configureanddeploythetechnicaladd-ons">https://docs.splunk.com/Documentation/ActiveDirectory/1.2.2/DeployAD/Configureanddeploythetechnicaladd-ons</A></P> <P>Let me know if this helps!!</P> Wed, 14 Mar 2018 08:19:47 GMT https://community.splunk.com/t5/Splunk-Dev/How-to-set-inputs-file-for-collect-WinEventLog-for-File/m-p/340838#M5208 deepashri_123 2018-03-14T08:19:47Z