https://community.splunk.com/t5/Getting-Data-In/Universal-Forwarder-wineventlog/m-p/578685#M102167 <P>Using the Splunk Universal Forwarder for windows.&nbsp; Does the forwarder identify the data as wineventlog?&nbsp; How is that set?</P> Thu, 16 Dec 2021 22:58:21 GMT jwilliams 2021-12-16T22:58:21Z https://community.splunk.com/t5/Getting-Data-In/Universal-Forwarder-wineventlog/m-p/578685#M102167 <P>Using the Splunk Universal Forwarder for windows.&nbsp; Does the forwarder identify the data as wineventlog?&nbsp; How is that set?</P> Thu, 16 Dec 2021 22:58:21 GMT https://community.splunk.com/t5/Getting-Data-In/Universal-Forwarder-wineventlog/m-p/578685#M102167 jwilliams 2021-12-16T22:58:21Z https://community.splunk.com/t5/Getting-Data-In/Universal-Forwarder-wineventlog/m-p/578686#M102168 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/222997">@jwilliams</a>&nbsp;</P><P>UF ships with Windows add-on which does the collection of winevent logs if the inputs are enabled while installation or can be done later as well.</P><P>A detailed post already exist here -&nbsp;<A href="https://community.splunk.com/t5/All-Apps-and-Add-ons/How-do-I-collect-basic-Windows-OS-Event-Log-data-from-my-Windows/m-p/440187" target="_blank">https://community.splunk.com/t5/All-Apps-and-Add-ons/How-do-I-collect-basic-Windows-OS-Event-Log-data-from-my-Windows/m-p/440187</A></P><P>Splunk docs here -&nbsp;<A href="https://docs.splunk.com/Documentation/WindowsAddOn/8.1.2/User/SourcetypesandCIMdatamodelinfo" target="_blank">https://docs.splunk.com/Documentation/WindowsAddOn/8.1.2/User/SourcetypesandCIMdatamodelinfo</A></P><P>---</P><P>an upvote would be appreciated if this reply helps!</P> Thu, 16 Dec 2021 23:07:08 GMT https://community.splunk.com/t5/Getting-Data-In/Universal-Forwarder-wineventlog/m-p/578686#M102168 venkatasri 2021-12-16T23:07:08Z