topic Re: Help with inputs.conf Stanza for the Azure AD MFA NPS Extension in Getting Data In

Help with inputs.conf Stanza for the Azure AD MFA NPS Extension

arfee_splunker — Tue, 12 Jul 2022 06:01:45 GMT

Hi all

Getting this message :

ERROR ExecProcessor [3700 ExecProcessor] - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exe"" splunk-winevtlog - WinEventMon::configure: Failed to find Event Log with channel name='Microsoft-AzureMfa-AuthZ/AuthZAdminCh'

I've tried numerous combinations in the stanza such as :

WinEventLog://Microsoft-AzureMfa-AuthZ/AuthZAdminCh

WinEventLog://Microsoft-AzureMfa-AuthZ-AuthZAdminCh

WinEventLog://Microsoft/AzureMfa/AuthZ/AuthZAdminCh

The Windows Event Log chain for the AuthZAdminCh source is in the attachment. Just not quite sure where I'm going wrong.

Appreciate some advice.

Re: Help with inputs.conf Stanza for the Azure AD MFA NPS Extension

arfee_splunker — Tue, 12 Jul 2022 06:04:21 GMT

Re: Help with inputs.conf Stanza for the Azure AD MFA NPS Extension

arfee_splunker — Thu, 14 Jul 2022 06:21:54 GMT

Powershell (get-winevent -listlog *).logname revealed that the channel is simply called "AuthZAdminCh"

( despite hierarchical ordering under Microsoft-AzureMfa-AuthZ as presented in Event viewer )

The proven stanza is as simple as : [WinEventLog://AuthZAdminCh]