https://community.splunk.com/t5/Getting-Data-In/Discrepancy-in-the-transfer-of-WinEventLog-Security-logs-through/m-p/376813#M68191 <P>We have 5 indexers and a standalone search head with no cluster configuration. Recently, we have observed that the WinEventLog: Security logs are not indexing properly and there seems to be a huge delay in indexing them.</P> <P>However, the other wineventlogs such as Application &amp; System logs are indexing as expected. There is no recent change for this on the universal forwarder (UF) nor on the indexer. We tried to check one incident for which we have not received any logs (log was in the server) then this issue came to know. </P> <P>We have Splunk 6.6.2 installed on both the UF &amp; indexers. Any idea what could be causing the issue?</P> Tue, 18 Sep 2018 05:03:25 GMT mbadhusha_splun 2018-09-18T05:03:25Z https://community.splunk.com/t5/Getting-Data-In/Discrepancy-in-the-transfer-of-WinEventLog-Security-logs-through/m-p/376813#M68191 <P>We have 5 indexers and a standalone search head with no cluster configuration. Recently, we have observed that the WinEventLog: Security logs are not indexing properly and there seems to be a huge delay in indexing them.</P> <P>However, the other wineventlogs such as Application &amp; System logs are indexing as expected. There is no recent change for this on the universal forwarder (UF) nor on the indexer. We tried to check one incident for which we have not received any logs (log was in the server) then this issue came to know. </P> <P>We have Splunk 6.6.2 installed on both the UF &amp; indexers. Any idea what could be causing the issue?</P> Tue, 18 Sep 2018 05:03:25 GMT https://community.splunk.com/t5/Getting-Data-In/Discrepancy-in-the-transfer-of-WinEventLog-Security-logs-through/m-p/376813#M68191 mbadhusha_splun 2018-09-18T05:03:25Z https://community.splunk.com/t5/Getting-Data-In/Discrepancy-in-the-transfer-of-WinEventLog-Security-logs-through/m-p/376814#M68192 <P>Hi,</P> <P>Based on <A href="http://docs.splunk.com/Documentation/Forwarder/6.6.2/Forwarder/KnownIssues">http://docs.splunk.com/Documentation/Forwarder/6.6.2/Forwarder/KnownIssues</A> , you might hitting below known issue </P> <PRE><CODE>2015-04-14 SPL-99687, SPL-129637 Splunk universal forwarder is 7-10 days behind recent Windows Security and system log events. Workaround: To mitigate this, edit the following stanza in inputs.conf: [WinEventLog://Security] evt_resolve_ad_obj = 0. </CODE></PRE> Tue, 18 Sep 2018 12:20:02 GMT https://community.splunk.com/t5/Getting-Data-In/Discrepancy-in-the-transfer-of-WinEventLog-Security-logs-through/m-p/376814#M68192 harsmarvania57 2018-09-18T12:20:02Z https://community.splunk.com/t5/Getting-Data-In/Discrepancy-in-the-transfer-of-WinEventLog-Security-logs-through/m-p/376815#M68193 <P>Made the below changes on the UF and restarted. Post which the Security logs were read from the oldest logs and the UF took some time to catch up with the latest logs. </P> <P>Under Program Files/SplunkUniversalforwarder/etc/system/local/inputs.conf, add </P> <P>[WinEventLog://Security] <BR /> evt_ad_cache_exp = 1200 <BR /> evt_ad_cache_exp_neg = 1200 <BR /> evt_ad_cache_max_entries = 40000 <BR /> evt_sid_cache_exp = 300 <BR /> evt_sid_cache_exp_neg = 300 <BR /> evt_sid_cache_max_entries = 4000 <BR /> checkpointinterval=300 <BR /> use_old_eventlog_api = 1 <BR /> evt_dc_name = localhost </P> <P>Under Program Files/SplunkUniversalforwarder/etc/system/local/outputs.conf, add </P> <P>[tcpout:primary_indexers] <BR /> tcpSendBufSz = 512000</P> <P>The above are the configurations suggested by the Splunk engineering team for the delay in indexing Windows security logs. The issue has been resolved after the changes.</P> Tue, 29 Sep 2020 21:17:44 GMT https://community.splunk.com/t5/Getting-Data-In/Discrepancy-in-the-transfer-of-WinEventLog-Security-logs-through/m-p/376815#M68193 mbadhusha_splun 2020-09-29T21:17:44Z