topic Running Splunk Enterprise on Windows 2008 R2, how do I index local security logs? in Getting Data In

Running Splunk Enterprise on Windows 2008 R2, how do I index local security logs?

ceichhorn — Wed, 22 Apr 2015 14:08:08 GMT

I'm running Splunk Enterprise on a Windows 2008 R2 server and I'm looking to index the local security logs for the server in to splunk. I can't seem to figure out how to do this: can someone help me with that? I'm sure it's rather simple, I just can't find it. Thanks!

Re: Running Splunk Enterprise on Windows 2008 R2, how do I index local security logs?

menonmanish — Wed, 22 Apr 2015 14:13:49 GMT

For Splunk 5, simply use the following in your inputs.conf
[WinEventLog:Security]
disabled = 0

For Splunk Latest release use
[WinEventLog://Security]
disabled = 0

Refer to http://docs.splunk.com/Documentation/Splunk/6.2.2/Data/MonitorWindowsdata for more details.

Re: Running Splunk Enterprise on Windows 2008 R2, how do I index local security logs?

ceichhorn — Wed, 22 Apr 2015 19:37:07 GMT

Thanks very much Meno, this got it.