https://community.splunk.com/t5/Getting-Data-In/Failed-to-find-Event-Log/m-p/363955#M66282 <P>Determined the correct channel name is <CODE>Microsoft-Windows-DNS-Client/Operational</CODE>. You can find the correct name by selecting an event, going to <EM>Details</EM> tab, under <EM>Friendly</EM> radio button, expand <EM>System</EM> and you'll see <STRONG>Channel</STRONG>.</P> Mon, 26 Jun 2017 18:30:40 GMT tmontney 2017-06-26T18:30:40Z https://community.splunk.com/t5/Getting-Data-In/Failed-to-find-Event-Log/m-p/363954#M66281 <PRE><CODE>[WinEventLog://Microsoft-Windows-DNS Client Events/Operational] disabled = 0 index = wineventlog interval = 60 </CODE></PRE> <P>What's wrong with this? I get the error in my splunk forwarder.</P> <PRE><CODE>06-26-2017 12:16:31.997 -0500 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exe"" splunk-winevtlog - WinEventMon::configure: Failed to find Event Log with channel name='Microsoft-Windows-DNS Client Events/Operational' </CODE></PRE> <P>I wrote the log name as shown in Event Viewer, and it is enabled.</P> Mon, 26 Jun 2017 18:05:02 GMT https://community.splunk.com/t5/Getting-Data-In/Failed-to-find-Event-Log/m-p/363954#M66281 tmontney 2017-06-26T18:05:02Z https://community.splunk.com/t5/Getting-Data-In/Failed-to-find-Event-Log/m-p/363955#M66282 <P>Determined the correct channel name is <CODE>Microsoft-Windows-DNS-Client/Operational</CODE>. You can find the correct name by selecting an event, going to <EM>Details</EM> tab, under <EM>Friendly</EM> radio button, expand <EM>System</EM> and you'll see <STRONG>Channel</STRONG>.</P> Mon, 26 Jun 2017 18:30:40 GMT https://community.splunk.com/t5/Getting-Data-In/Failed-to-find-Event-Log/m-p/363955#M66282 tmontney 2017-06-26T18:30:40Z