https://community.splunk.com/t5/Getting-Data-In/Lots-of-WinEventLogChannel-subscribeToEvtChannel/m-p/56961#M11118 <P>Not all Windows Event log collection that appears in Manager » Data inputs » Event log collections » localhost can be subscribed. <A href="http://technet.microsoft.com/en-us/library/cc722010.aspx" rel="nofollow">Check Microsoft Site</A></P> <P>Also, please note, Splunk has a threshold of 63 that you can select from Available logs. Selecting more than threshold limit will cause problem. In other words, do not add all.</P> Fri, 24 Sep 2010 00:31:04 GMT elusive 2010-09-24T00:31:04Z https://community.splunk.com/t5/Getting-Data-In/Lots-of-WinEventLogChannel-subscribeToEvtChannel/m-p/56960#M11117 <P>There are a lot of these error messages logged in splunkd.log</P> <PRE><CODE>09-23-2010 09:31:28.062 ERROR WinEventLogChannel - subscribeToEvtChannel: Could not subscribe to Windows Event Log channel 'Microsoft-Windows-TaskScheduler/Diagnostic', 'The caller is trying to subscribe to a direct channel which is not allowed. The events for a direct channel go directly to a logfile and cannot be subscribed to.'. 09-23-2010 09:31:28.062 ERROR WinEventLogChannel - init: Init failed, unable to subscribe to Windows Event Log channel 'Microsoft-Windows-TaskScheduler/Diagnostic': 09-23-2010 09:31:28.062 ERROR WinEventLogInputProcessor - main-thread: Failed to initialize Windows Event Log 'Microsoft-Windows-TaskScheduler/Diagnostic' </CODE></PRE> Fri, 24 Sep 2010 00:23:11 GMT https://community.splunk.com/t5/Getting-Data-In/Lots-of-WinEventLogChannel-subscribeToEvtChannel/m-p/56960#M11117 elusive 2010-09-24T00:23:11Z https://community.splunk.com/t5/Getting-Data-In/Lots-of-WinEventLogChannel-subscribeToEvtChannel/m-p/56961#M11118 <P>Not all Windows Event log collection that appears in Manager » Data inputs » Event log collections » localhost can be subscribed. <A href="http://technet.microsoft.com/en-us/library/cc722010.aspx" rel="nofollow">Check Microsoft Site</A></P> <P>Also, please note, Splunk has a threshold of 63 that you can select from Available logs. Selecting more than threshold limit will cause problem. In other words, do not add all.</P> Fri, 24 Sep 2010 00:31:04 GMT https://community.splunk.com/t5/Getting-Data-In/Lots-of-WinEventLogChannel-subscribeToEvtChannel/m-p/56961#M11118 elusive 2010-09-24T00:31:04Z