topic Re: After adding data from Windows event logs, why am I getting only one event from one source? in Getting Data In

After adding data from Windows event logs, why am I getting only one event from one source?

rajuljain1990 — Tue, 28 Oct 2014 05:37:10 GMT

After adding data from Windows event logs (system, security, application, setup), I only got one event for yesterday's date and only from one source "security log". Why is this and how should I troubleshoot the problem?

Re: After adding data from Windows event logs, why am I getting only one event from one source?

bkondakindi — Tue, 28 Oct 2014 17:56:07 GMT

check on forwarder side there might be duplicate inputs.conf file that is sending data.
we had similar issues so find all inputs.conf on UF side and verify it.

Re: After adding data from Windows event logs, why am I getting only one event from one source?

rsolutions — Wed, 03 Dec 2014 03:33:25 GMT

Have you tried searching all of the indexes:

index=*

By default the Windows TA's log to a wineventlog index. Only the main index is searched by default (unless you change it in the roles).