topic Universal forwarder configured to collect application event logs in Getting Data In

Universal forwarder configured to collect application event logs

aimeedillon13 — Wed, 04 Oct 2017 09:53:58 GMT

Trying to collect specific GPO event codes so we've created an app on the universal forwarder with the below in the inputs.conf file:

[WinEventLog://Application]
disabled = 0
current_only = 1
evt_resolve_ad_obj = 1
checkpointInterval = 300
whitelist = 5126,5257,5312,5313,1069,1128,4098
blacklist1 = EventCode="4662" Message="Object Type:\s+(?!groupPolicyContainer)"
blacklist2 = EventCode="566" Message="Object Type:\s+(?!groupPolicyContainer)"
index = wineventlog
renderXml=false

I can see the event logs on the server but can't see any in splunk. The wineventlog index already exists.

Re: Universal forwarder configured to collect application event logs

aimeedillon13 — Tue, 17 Oct 2017 11:07:49 GMT

By changing the first line to the below I got what I was after:

[WinEventLog://Microsoft-Windows-GroupPolicy/Operational]

Re: Universal forwarder configured to collect application event logs

richgalloway — Tue, 17 Oct 2017 12:45:37 GMT

@aimeedillon13, If your problem is resolved, please accept the answer to help future readers.