topic Re: Forwarder add Windows Event log command line in Getting Data In

Forwarder add Windows Event log command line

kceleslie — Wed, 16 Apr 2014 14:31:16 GMT

Is it possible to add to the splunk forwarder via the command line items from Windows Event viewer? I know we can update inputs.conf but is it possible via the command line?

If it is possible, shouldn't monitored event log items show up when you list monitored items?

splunk list monitor

Doesn't display event log items. Thanks

Re: Forwarder add Windows Event log command line

martin_mueller — Wed, 16 Apr 2014 16:47:12 GMT

Those don't show up in splunk list monitor because a Windows event log entry looks like this:

[WinEventLog://<name>]

rather than this:

[monitor://<path>]

Hence they're not monitor type stanzas.

Re: Forwarder add Windows Event log command line

martin_mueller — Wed, 16 Apr 2014 16:49:52 GMT

Give this a try for listing:

splunk list eventlog

Re: Forwarder add Windows Event log command line

kceleslie — Wed, 16 Apr 2014 17:18:08 GMT

Thanks!
Just found this, looks like it is not possible with the CLI
http://answers.splunk.com/answers/9389/configuring-a-light-forwarder-to-monitor-the-windows-event-log-from-the-cli

Re: Forwarder add Windows Event log command line

martin_mueller — Wed, 16 Apr 2014 17:29:26 GMT

You should be able to make a REST call against yourself from the CLI using this endpoint: http://docs.splunk.com/Documentation/Splunk/latest/RESTAPI/RESTinput#POST_data.2Finputs.2Fwin-event-log-collections

Re: Forwarder add Windows Event log command line

splunker12er — Wed, 01 Oct 2014 11:27:05 GMT

Monitored Event Log Collections:
        localhost
                disabled:1
                hosts:localhost
                index:default
                logs:
                        Application
                        ForwardedEvents
                        HardwareEvents
                        Internet Explorer
                        Security
                        Setup
                        System

Just got the above as the result of

C:\Program Files\SplunkUniversalForwarder\bin>splunk list eventlog

how to enable the log monitor ?

Re: Forwarder add Windows Event log command line

bbiandov — Thu, 24 Mar 2016 03:57:56 GMT

edit C:\Program Files\SplunkUniversalForwarder\etc\system\local\inputs.conf and add:

[WinEventLog://Application]
disabled = 0 
[WinEventLog://Security]
disabled = 0 
[WinEventLog://System]
disabled = 0 
[WinEventLog://DNS Server]
disabled = 0

Then restart the windows service for the universal forwarder to re-read the changes.