https://community.splunk.com/t5/Getting-Data-In/How-to-configure-inputs-conf-to-get-PowerShell-and-WinRM-event/m-p/234847#M45741 <P>I've been asked to index both Operational.evtx and Analytic.etl from both \Winevt\Logs\Microsoft-Windows-WinRM and \Winevt\Logs\Microsoft-Windows-PowerShell from a few Windows hosts.</P> <P>I'm not quite sure how to configure the inputs.conf for this. I'm guessing that it's something like:</P> <PRE><CODE>[WinEventLog:PowerShell] disabled = 1 start_from = oldest current_only = 0 evt_resolve_ad_obj = 1 checkpointInterval = 5 renderXml=false or [WinEventLog:WinRM] .. </CODE></PRE> <P>But again, not really clear. (and not at all Windows literate) And then how do you differentiate between the Operational and Analytic objects. </P> <P>Thank you</P> Wed, 29 Jun 2016 18:29:53 GMT pkeller 2016-06-29T18:29:53Z https://community.splunk.com/t5/Getting-Data-In/How-to-configure-inputs-conf-to-get-PowerShell-and-WinRM-event/m-p/234847#M45741 <P>I've been asked to index both Operational.evtx and Analytic.etl from both \Winevt\Logs\Microsoft-Windows-WinRM and \Winevt\Logs\Microsoft-Windows-PowerShell from a few Windows hosts.</P> <P>I'm not quite sure how to configure the inputs.conf for this. I'm guessing that it's something like:</P> <PRE><CODE>[WinEventLog:PowerShell] disabled = 1 start_from = oldest current_only = 0 evt_resolve_ad_obj = 1 checkpointInterval = 5 renderXml=false or [WinEventLog:WinRM] .. </CODE></PRE> <P>But again, not really clear. (and not at all Windows literate) And then how do you differentiate between the Operational and Analytic objects. </P> <P>Thank you</P> Wed, 29 Jun 2016 18:29:53 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-configure-inputs-conf-to-get-PowerShell-and-WinRM-event/m-p/234847#M45741 pkeller 2016-06-29T18:29:53Z https://community.splunk.com/t5/Getting-Data-In/How-to-configure-inputs-conf-to-get-PowerShell-and-WinRM-event/m-p/234848#M45742 <PRE><CODE>[WinEventLog://Microsoft-Windows-PowerShell/Operational] disabled = false [WinEventLog://Microsoft-Windows-WinRM/Operational] disabled = false </CODE></PRE> Sat, 09 Jul 2016 03:33:32 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-configure-inputs-conf-to-get-PowerShell-and-WinRM-event/m-p/234848#M45742 spayneort 2016-07-09T03:33:32Z https://community.splunk.com/t5/Getting-Data-In/How-to-configure-inputs-conf-to-get-PowerShell-and-WinRM-event/m-p/234849#M45743 <P>The following speaks about it - <A href="http://blogs.splunk.com/2014/02/03/forwarding-windows-event-logs-to-another-host/">Forwarding Windows Event Logs to another host</A></P> <P>In Step 4, it shows - </P> <PRE><CODE>[WinEventLog://SOURCE-Security] sourcetype = WinEventLog:Security host = SOURCE disabled = false </CODE></PRE> Sun, 10 Jul 2016 20:59:30 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-configure-inputs-conf-to-get-PowerShell-and-WinRM-event/m-p/234849#M45743 ddrillic 2016-07-10T20:59:30Z