https://community.splunk.com/t5/Getting-Data-In/WinEventLog-Security-from-all-hosts/m-p/92864#M19316 <P>Never Mind. I had it set up right. I was just typing the wrong name in sourcetype query.</P> Fri, 12 Apr 2013 23:28:23 GMT lain179 2013-04-12T23:28:23Z https://community.splunk.com/t5/Getting-Data-In/WinEventLog-Security-from-all-hosts/m-p/92861#M19313 <P>I have a silly question. I found this from docs.splunk.com but how do I configure it so that Splunk can get event logs from all hosts? Right now it's just grabbing security events from the forwarder but not any other servers.</P> <PRE> [WinEventLog:Security] disabled = 0 start_from = newest evt_dc_name = evt_dns_name = evt_resolve_ad_obj = 1 checkpointInterval = 5 </PRE> Fri, 12 Apr 2013 21:33:33 GMT https://community.splunk.com/t5/Getting-Data-In/WinEventLog-Security-from-all-hosts/m-p/92861#M19313 lain179 2013-04-12T21:33:33Z https://community.splunk.com/t5/Getting-Data-In/WinEventLog-Security-from-all-hosts/m-p/92862#M19314 <P>In order to read logs from other hosts you would either have to a) install forwarders on them too, or b) setup WMI polling of logs from your Splunk instance towards the hosts you're interested in retrieving logs from. For the second case, see more info here: <A href="http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/MonitorWMIdata">http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/MonitorWMIdata</A></P> Fri, 12 Apr 2013 22:13:35 GMT https://community.splunk.com/t5/Getting-Data-In/WinEventLog-Security-from-all-hosts/m-p/92862#M19314 Ayn 2013-04-12T22:13:35Z https://community.splunk.com/t5/Getting-Data-In/WinEventLog-Security-from-all-hosts/m-p/92863#M19315 <P>I am already able to monitor disk and CPU usage and what not. That means I have already established the WMI connection, correct? I have already visited that page, and it confused me more.</P> Fri, 12 Apr 2013 22:18:20 GMT https://community.splunk.com/t5/Getting-Data-In/WinEventLog-Security-from-all-hosts/m-p/92863#M19315 lain179 2013-04-12T22:18:20Z https://community.splunk.com/t5/Getting-Data-In/WinEventLog-Security-from-all-hosts/m-p/92864#M19316 <P>Never Mind. I had it set up right. I was just typing the wrong name in sourcetype query.</P> Fri, 12 Apr 2013 23:28:23 GMT https://community.splunk.com/t5/Getting-Data-In/WinEventLog-Security-from-all-hosts/m-p/92864#M19316 lain179 2013-04-12T23:28:23Z https://community.splunk.com/t5/Getting-Data-In/WinEventLog-Security-from-all-hosts/m-p/92865#M19317 <P>Please review this link for forwarding window events log to another host</P> <P><A href="http://blogs.splunk.com/2014/02/03/forwarding-windows-event-logs-to-another-host/">http://blogs.splunk.com/2014/02/03/forwarding-windows-event-logs-to-another-host/</A></P> Sat, 01 Nov 2014 04:49:34 GMT https://community.splunk.com/t5/Getting-Data-In/WinEventLog-Security-from-all-hosts/m-p/92865#M19317 cdo_splunk 2014-11-01T04:49:34Z