Splunk server running on Win2008 R2 Server not showing R2 Logs

wy1z — Tue, 17 Apr 2012 14:28:03 GMT

My setup involved 4 VMs - RHEL 5.6, Windows 7 Enterprise, Windows Server 2008 R2, and Windows XP w/SP3.

Splunk server is installed on the Win 2008 box, and the SUF is installed on the other systems.

The issue I have is the 2008 server logs are NOT showing up in Splunk (which is where Splunk is installed to begin with).

Any help would be most appreciated.

Scott

Re: Splunk server running on Win2008 R2 Server not showing R2 Logs

tgow — Tue, 17 Apr 2012 14:56:02 GMT

What user are you running Splunk as?

Have you selected the Event Logs that you want to monitor?

Manager-->Data Inputs-->Local event log collection

Make sure that the desired event log channels are selected in Splunk Web or properly configured in inputs.conf.

Make sure to select fewer than 64 event log channels per event log input.

Make sure that you are not attempting to index exported event logs that are incompatible with the indexing system (for example, attempting to index event logs exported from a Windows Server 2008 computer on a Windows XP computer will result in missing log data).

Make sure that, if you are monitoring non-standard event log channels, that you have the appropriate dynamic linked libraries (DLLs) that are associated with that event log channel. This is particularly important when indexing exported log files from a different computer.

topic Splunk server running on Win2008 R2 Server not showing R2 Logs in Getting Data In

Splunk server running on Win2008 R2 Server not showing R2 Logs

Re: Splunk server running on Win2008 R2 Server not showing R2 Logs