topic Not receiving all windows logs from clients in Getting Data In

Not receiving all windows logs from clients

izyknows — Sun, 29 Aug 2021 16:20:17 GMT

Hello,

I'm trying to setup Splunk in a lab environment. I've got one windows client which I want to send logs over to my Splunk server via a UF.

I am managing the endpoint's splunk config via a deployment server. This works fine, the client checks in, my apps get pushed to it, all fine. For windows logs, I'm using the Splunk TA for Windows (https://splunkbase.splunk.com/app/742/#/overview) with an inputs.conf as below

[WinEventLog://Security] disabled = 0 start_from = oldest current_only = 0 renderXml=true evt_resolve_ad_obj = 1 index = windows [WinEventLog://System] disabled = 0 renderXml=true evt_resolve_ad_obj = 1 index = windows [WinEventLog://Application] disabled = 0 renderXml=true evt_resolve_ad_obj = 1 index = windows

The app gets deployed correctly and I see the above inputs.conf in the %SPLUNK_HOME%/apps/Splunk_TA_windows/local/inputs.conf.

However, in Splunk, I don't seem to be getting all the logs. In fact, I'm only getting event id 6xxx logs and very few (43 events/15mins)

I can't figure out why all the logs aren't coming in but only a few irrelevant ones. Any help will be much appreciated. Thank you!

Re: Not receiving all windows logs from clients

richgalloway — Sun, 29 Aug 2021 18:43:23 GMT

Did you configure the DS to have the UF restart after downloading the app?

Re: Not receiving all windows logs from clients

izyknows — Sun, 29 Aug 2021 20:39:24 GMT

Yes I did. Restarted the deployment server so the apps would get distributed again too. No luck 😞

Re: Not receiving all windows logs from clients

izyknows — Mon, 01 Nov 2021 14:22:41 GMT

Okay, fixed. It was the permission of the user. For some reason, a domain user who is part of the local admins group did not cut it and made Splunk respond in weird ways in terms of picking up logs. Redeployed UF with Local System and it works. Next time I try it with a non-local account, I'll manage it with gMSA. But for now, it works 🙂

Thank you