topic How to resend the specific event log from Windows Universal Forwarder in Getting Data In

How to resend the specific event log from Windows Universal Forwarder

kuga_mbsd — Wed, 06 Jul 2016 01:54:07 GMT

Hello Splunkers,

We are collecting the Security Event Log from Windows 2012 Server which has Universal Forwarder installed, and I found that some of the logs were not sent to Indexer even though UseAck=true.
Is there a anyway to send only the specific logs to Indexer?

Thanks in advance,

Re: How to resend the specific event log from Windows Universal Forwarder

muebel — Tue, 29 Sep 2020 10:08:24 GMT

Hi kuga_mbsd, You could perhaps build a WMI query to get specific eventcodes, reviewing the documentation here might help : http://docs.splunk.com/Documentation/Splunk/latest/Data/MonitorWMIdata#Examples_of_wmi.conf

My next guess would be a script based oneshot gathering the events together as text (xml probably) and indexing the results.

Please let me know if this answers your question! 😄

Re: How to resend the specific event log from Windows Universal Forwarder

kuga_mbsd — Wed, 06 Jul 2016 02:40:51 GMT

Hi muebel,

Thank you for your answers.
Regarding the URL you gave me is pulling the logs on the remote Windows host, is that right?
Unfortunately Indexer doesn't have access to the server since Firewall is blocking.

Do you think if Universal Forwarder will send the only specific logs by executing some commands?

Thank you,

Re: How to resend the specific event log from Windows Universal Forwarder

muebel — Wed, 06 Jul 2016 12:47:24 GMT

Yup, you can use powershell to retrieve specific eventlogs described in more detail here : https://technet.microsoft.com/en-us/library/hh849834.aspx

i.e.,

Get-EventLog -LogName "*Security*" -Message "*the message you are looking for*"

Re: How to resend the specific event log from Windows Universal Forwarder

woodcock — Wed, 06 Jul 2016 16:24:53 GMT

The UseAck=true should help you prove where the breakdown did/not happen but there is no reason that the forwarding should not normally be reliable. I have some skepticism that "some" events did not make it in, if everything is configured correctly. We need to see your inputs.conf to be sure.