Splunk-winevtlog event missing in Splunk

Singh10 — Tue, 25 Feb 2025 17:51:24 GMT

Hi I have the following conf for Application events:

[WinEventLog://Application] _TCP_ROUTING = sample current_only = 0 disabled = false index = eventviewer sourcetype = applicationevents start_from = oldest blacklist1 = EventCode="^(33)" SourceName="^Chrome$"

I have EventCode 256 events in the Application logs under Source Chrome, but I do not see those any of those events in Splunk for some reason. I don't see any errors in the splunkd.log. What could be the reason for this? I would really appreciate insight on this.

Re: Splunk-winevtlog event missing in Splunk

gcusello — Wed, 26 Feb 2025 13:49:56 GMT

Hi @Singh10 ,

why are you using _TCP_ROUTING?

did you configured the sample value on outputs.conf?

Ciao.

Giuseppe

topic Splunk-winevtlog event missing in Splunk in Getting Data In

Splunk-winevtlog event missing in Splunk

Re: Splunk-winevtlog event missing in Splunk