https://community.splunk.com/t5/Getting-Data-In/How-can-I-make-the-sourcetype-WinEventLog-Application-active/m-p/373368#M67683 <P>abl-bccwprhyb01 07/19/2017 22:17:10 sqleventlog WinEventLog:Application EPS INACTIVE (7-30days)</P> <P>Source type WinEventLog:Application is inactive for sqlevent index</P> <P>in error and warnings it showing no result found. that's why I am not able to check exactly what I need to check and where and how can I make this source type WinEventLog:Application active. Please help</P> Fri, 18 Aug 2017 05:14:40 GMT asorot 2017-08-18T05:14:40Z https://community.splunk.com/t5/Getting-Data-In/How-can-I-make-the-sourcetype-WinEventLog-Application-active/m-p/373368#M67683 <P>abl-bccwprhyb01 07/19/2017 22:17:10 sqleventlog WinEventLog:Application EPS INACTIVE (7-30days)</P> <P>Source type WinEventLog:Application is inactive for sqlevent index</P> <P>in error and warnings it showing no result found. that's why I am not able to check exactly what I need to check and where and how can I make this source type WinEventLog:Application active. Please help</P> Fri, 18 Aug 2017 05:14:40 GMT https://community.splunk.com/t5/Getting-Data-In/How-can-I-make-the-sourcetype-WinEventLog-Application-active/m-p/373368#M67683 asorot 2017-08-18T05:14:40Z https://community.splunk.com/t5/Getting-Data-In/How-can-I-make-the-sourcetype-WinEventLog-Application-active/m-p/373369#M67684 <P>in your inputs.conf add the stanza as shown below : </P> <P>[WinEventLog://Application]<BR /> disabled = 0</P> Sun, 29 Jul 2018 17:04:09 GMT https://community.splunk.com/t5/Getting-Data-In/How-can-I-make-the-sourcetype-WinEventLog-Application-active/m-p/373369#M67684 joechakkola1 2018-07-29T17:04:09Z