https://community.splunk.com/t5/Getting-Data-In/Why-are-my-Windows-security-logs-not-coming-from-forwarders/m-p/383876#M69090 <P>What could be the possible reason that Windows security logs are not coming from the forwarders?</P> <P>How do I troubleshoot it?</P> <P>Please let me know if you need any additional information.</P> Wed, 02 Jan 2019 15:09:33 GMT muizash 2019-01-02T15:09:33Z https://community.splunk.com/t5/Getting-Data-In/Why-are-my-Windows-security-logs-not-coming-from-forwarders/m-p/383876#M69090 <P>What could be the possible reason that Windows security logs are not coming from the forwarders?</P> <P>How do I troubleshoot it?</P> <P>Please let me know if you need any additional information.</P> Wed, 02 Jan 2019 15:09:33 GMT https://community.splunk.com/t5/Getting-Data-In/Why-are-my-Windows-security-logs-not-coming-from-forwarders/m-p/383876#M69090 muizash 2019-01-02T15:09:33Z https://community.splunk.com/t5/Getting-Data-In/Why-are-my-Windows-security-logs-not-coming-from-forwarders/m-p/383877#M69091 <P>There are few more likely reasons.</P> <P>1) The forwarders are not running<BR /> 2) A firewall/networking change is preventing the forwarders from communicating with the indexers<BR /> 3) SSL certificates have expired</P> <P>You should find clues in Splunk's log files. Search <CODE>index=_internal group=tcpin_connections</CODE>.</P> Wed, 02 Jan 2019 18:36:54 GMT https://community.splunk.com/t5/Getting-Data-In/Why-are-my-Windows-security-logs-not-coming-from-forwarders/m-p/383877#M69091 richgalloway 2019-01-02T18:36:54Z