https://community.splunk.com/t5/Getting-Data-In/How-to-configure-Splunk-to-aggregate-security-access-event-logs/m-p/304567#M57442 <P>Yes, I turned on Auditing and I can see records being generated in the Security Log regarding access to folders, etc. The only records I am seeing in the tool on my standalone PC are like performance records. I installed the Forwarding Agent on the server. Maybe I need to configure that differently?</P> Mon, 22 May 2017 16:47:54 GMT presbia_Marc 2017-05-22T16:47:54Z https://community.splunk.com/t5/Getting-Data-In/How-to-configure-Splunk-to-aggregate-security-access-event-logs/m-p/304564#M57439 <P>I was hoping that I could get security events with the forwarder. I installed the forwarder but all I am getting are system metrics. How do I configure this to do what I need for auditing purposes?</P> Fri, 19 May 2017 22:43:10 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-configure-Splunk-to-aggregate-security-access-event-logs/m-p/304564#M57439 presbia_Marc 2017-05-19T22:43:10Z https://community.splunk.com/t5/Getting-Data-In/How-to-configure-Splunk-to-aggregate-security-access-event-logs/m-p/304565#M57440 <P>Do this:</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.6.0/Data/MonitorWindowseventlogdata">http://docs.splunk.com/Documentation/Splunk/6.6.0/Data/MonitorWindowseventlogdata</A></P> Fri, 19 May 2017 22:56:15 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-configure-Splunk-to-aggregate-security-access-event-logs/m-p/304565#M57440 woodcock 2017-05-19T22:56:15Z https://community.splunk.com/t5/Getting-Data-In/How-to-configure-Splunk-to-aggregate-security-access-event-logs/m-p/304566#M57441 <P>the doc linked in the answer below is great.<BR /> however, what are your "auditing purposes"? if its windows (assumed since you mentioned system), is your OS configured to capture these events e.g. windows security and audit rules turned on correctly? if linux, maybe auditd needed etc...<BR /> in any case, please elaborate / be more specific so we can better assist you<BR /> hope it helps</P> Sat, 20 May 2017 02:12:50 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-configure-Splunk-to-aggregate-security-access-event-logs/m-p/304566#M57441 adonio 2017-05-20T02:12:50Z https://community.splunk.com/t5/Getting-Data-In/How-to-configure-Splunk-to-aggregate-security-access-event-logs/m-p/304567#M57442 <P>Yes, I turned on Auditing and I can see records being generated in the Security Log regarding access to folders, etc. The only records I am seeing in the tool on my standalone PC are like performance records. I installed the Forwarding Agent on the server. Maybe I need to configure that differently?</P> Mon, 22 May 2017 16:47:54 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-configure-Splunk-to-aggregate-security-access-event-logs/m-p/304567#M57442 presbia_Marc 2017-05-22T16:47:54Z