topic Universal forwarder doesn't have a default setting in inputs.conf for Microsoft-Windows-PowerShell/Operational in Getting Data In

Universal forwarder doesn't have a default setting in inputs.conf for Microsoft-Windows-PowerShell/Operational

spctravis — Mon, 27 Jun 2022 21:43:44 GMT

Splunkers,

I want to get in Microsoft-Windows-PowerShell/Operational logs into Splunk. There is no default setting for it in the default/inputs.conf file.

I think this is the answer:

[WinEventLog://Microsoft-Windows-PowerShell/Operational]
disabled=0

Re: Universal forwarder doesn't have a default setting in inputs.conf for Microsoft-Windows-PowerShell/Operational

danielcj — Tue, 28 Jun 2022 06:29:38 GMT

Hello,

Yes, it is the correct input, you should place this input on an inputs.conf file on a /local/ folder, don't forget to set an index and a sourcetype, for example:

[WinEventLog://Microsoft-Windows-PowerShell/Operational] index=<my_index> sourcetype=<my_sourcetype> disabled=false