topic Windows 2008 Server Event Viewer Logs in Getting Data In

Windows 2008 Server Event Viewer Logs

kbecker — Tue, 31 Aug 2010 05:34:59 GMT

In the Server 2008 Event Viewer there are now a "Microsoft --> Windows" folders nested under the "Applications and Services Logs" section. What should the Splunk inputs.conf look like for the event logs under the "Microsoft" --> "Windows" folder. Specifically I am looking for the "PrintService --> Operational", but if anybody has any of these other logs being indexed the base input should be the same

**%SystemRoot%\System32\Winevt\Logs\Microsoft-Windows-**PrintService%4Operational.evtx

I tried the following with no success...

[WinEventLog:Microsoft:Windows:PrintService Operational]
[WinEventLog:PrintService Operational]

Thanks in advance...

Re: Windows 2008 Server Event Viewer Logs

kbecker — Sat, 04 Sep 2010 04:52:35 GMT

This is stanza required

[WinEventLog:Microsoft-Windows-PrintService/Operational]

Thanks to Ellen Hom with Splunk Support

Re: Windows 2008 Server Event Viewer Logs

cervelli — Thu, 14 Oct 2010 02:45:16 GMT

The add data interface will list these out as well. Even if you intended to deploy to a forwarder, you can still create the stanza as a sample on one Splunk to make sure the syntax is correct.

Re: Windows 2008 Server Event Viewer Logs

patelpin — Mon, 03 Jun 2013 15:27:55 GMT

Are you using "Splunk Forwarder" on the target Machine????

Re: Windows 2008 Server Event Viewer Logs

AaronMoorcroft — Wed, 09 Apr 2014 08:51:47 GMT

So is that all you need to have in your input.conf file ? or do you need somthing somewhere else ? I need to monitor that particular event log however im getting nothing currently, I did merge that event log with the system event log which did sort or work but not as I need it to.

Re: Windows 2008 Server Event Viewer Logs

AaronMoorcroft — Mon, 28 Sep 2020 16:21:02 GMT

dont worry managed to get it working with this -

[WinEventLog:Microsoft-Windows-PrintService/Operational]
disabled = 0
start_from = oldest
current_only = 0

after some restarting if the forwarders 🙂