topic Re: How do I monitor Forwarded Events logs on Windows? in Getting Data In

How do I monitor Forwarded Events logs on Windows?

ericlarsen — Wed, 21 Sep 2016 16:51:09 GMT

I'm trying to monitor Forwarded Events logs on Windows (not application, system, etc.)?

My inputs.conf stanza looks like this:

[WinEventLog://Forwarded Events]

Doesn't seem to work. Anyone had success monitoring this type of event log?

Any help would be much appreciated.
Thanks!

skoelpin — Wed, 21 Sep 2016 17:14:40 GMT

Try adding the sourcetype and index in the stanza so it looks like this..

[WinEventLog://System]
index = YOUR_INDEX
sourcetype = winEventLogs

Also, do you have the outputs.conf pointing to your indexer?

ericlarsen — Wed, 21 Sep 2016 17:22:07 GMT

I don't want to monitor System event logs, I want to monitor Forwarded Events event logs.

I know the UF is working because I can search other data from the same server.

TStrauch — Wed, 21 Sep 2016 18:49:15 GMT

Hi ericlarsen,

just try this. Ignore the Space between "Forwarded Events".

[WinEventLog://ForwardedEvents]
index= YOUR_INDEX
disabled = 0

regards

ericlarsen — Thu, 22 Sep 2016 10:58:24 GMT

Unfortunately that did not fix the issue.

TStrauch — Tue, 29 Sep 2020 11:07:35 GMT

Then you have a problem on any other place.

Example from the official inputs.conf documentation of Splunk.

Monitor Windows event logs ForwardedEvents, this time only gathering the
events happening after first starting to monitor, going forward in time.

[WinEventLog://ForwardedEvents]
disabled = 0
start_from = oldest
current_only = 1
batch_size = 10
checkpointInterval = 5

ignoring the extra parameter this is the right stanza for the inputs.conf.

ericlarsen — Thu, 22 Sep 2016 19:39:31 GMT

Not sure why, but it works now. Thanks!

ericlarsen — Fri, 23 Sep 2016 16:22:53 GMT

For those curious, I figured out why it just started suddenly working. I didn't have 'Restart Splunk' selected for the app on the Deployment Manager.

Again, TStrauch, thanks for the help with the monitor stanza.