https://community.splunk.com/t5/Getting-Data-In/How-to-configure-the-forwarding-of-Microsoft-Windows-Print/m-p/367105#M66738 <P>Any splunk master </P> Tue, 21 Mar 2017 05:50:11 GMT navdeepsingh83 2017-03-21T05:50:11Z https://community.splunk.com/t5/Getting-Data-In/How-to-configure-the-forwarding-of-Microsoft-Windows-Print/m-p/367104#M66737 <P>Hi Guys,<BR /> I have installed universal forwarder on Print server, Windows Server 2012 R2 and configured the receiver IP and Port on it. <BR /> On the Splunk deployment server, I tried to configure Windows Event Logs (Collect event logs from forwarders.) under Data Inputs however I don't see PrinterServer logs.</P> <P>Screenshot: <A href="https://imgur.com/mEj1Kp5">https://imgur.com/mEj1Kp5</A></P> <P>I have configured the inputs.conf under local directory with the following and restarted the splunkuniversalforwarder service</P> <PRE><CODE>[default] host = PrintServer2012 [WinEventLog://Microsoft-Windows-PrintService/Operational] disabled = 0 renderXml = 1 checkpointInterval = 5 evt_resolve_ad_obj = 1 start_from = newest # only index events with these event IDs. whitelist = 307,805 </CODE></PRE> <P>Any ideas how to get the logs into the Splunk?</P> Mon, 20 Mar 2017 03:00:48 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-configure-the-forwarding-of-Microsoft-Windows-Print/m-p/367104#M66737 navdeepsingh83 2017-03-20T03:00:48Z https://community.splunk.com/t5/Getting-Data-In/How-to-configure-the-forwarding-of-Microsoft-Windows-Print/m-p/367105#M66738 <P>Any splunk master </P> Tue, 21 Mar 2017 05:50:11 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-configure-the-forwarding-of-Microsoft-Windows-Print/m-p/367105#M66738 navdeepsingh83 2017-03-21T05:50:11Z https://community.splunk.com/t5/Getting-Data-In/How-to-configure-the-forwarding-of-Microsoft-Windows-Print/m-p/367106#M66739 <P>Ok, I can see the data in the splunk server however i didn't explicitly added it under data&gt;inputs. </P> <P>Is there any ways to verify which forwarders are forwarding which sort of data?</P> Wed, 22 Mar 2017 03:55:37 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-configure-the-forwarding-of-Microsoft-Windows-Print/m-p/367106#M66739 navdeepsingh83 2017-03-22T03:55:37Z https://community.splunk.com/t5/Getting-Data-In/How-to-configure-the-forwarding-of-Microsoft-Windows-Print/m-p/630890#M108138 <P>I would create a new index name call winprinmon and the specify it in in the input file. Also make sure you enable have enable&nbsp;Microsoft-Windows-PrintService/Operational in Windows Event Viewer and configure GP under computer configuration&gt; admin templates&gt; Printers&gt; Allow job name in event logs to enable. To see files name being printing.<BR /><BR />[WinEventLog://Microsoft-Windows-PrintService/Operational]<BR />disabled = 0<BR />renderXml = 1<BR />checkpointInterval = 5<BR />evt_resolve_ad_obj = 1<BR />start_from = newest<BR /># only index events with these event IDs.<BR />whitelist = 307,805<BR />index=winprinmon</P> Wed, 15 Feb 2023 00:12:23 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-configure-the-forwarding-of-Microsoft-Windows-Print/m-p/630890#M108138 EzSQZ 2023-02-15T00:12:23Z