No event from WinEventLog://Microsoft-Windows-TaskScheduler/Operational

budimaos — Wed, 30 Sep 2020 00:58:47 GMT

Hello,

I have the following entry on the inputs.conf on the Universal Forwarder App to collect all the windows task scheduler log:

[WinEventLog://Microsoft-Windows-TaskScheduler/Operational]
disabled = false
sourcetype = WinEvent:TS
index=prd_xxx

and I have the following entry on the HF app props.conf just to route them to the correct index cluster

[WinEventLog:TaskScheduler]
TRANSFORMS-routing = routeMe
disabled=false

Other logs on the same server with the same routing are coming in just fine, but I don't see a single event for the task scheduler even though we can see new events on the event viewer every minute or so.

There's no error message on the splunkd.log, and I can see the following entry on the metrics.log

06-20-2019 22:20:57.646 +1000 INFO Metrics - group=per_sourcetype_thruput, series="wineventlog:microsoft-windows-taskscheduler/operational", kbps=0.259293, eps=1.032258, kb=8.038086, ev=32, avg_age=1.000000, max_age=1

So I suppose it should have been coming in somewhere, but I just couldn't find it. It's not there on the target index nor the default index. Now I'm not entirely sure if it's actually being read.

The splunkforwarder is already running as a "Local System" on the box and we're using v6.1.1 at the moment.

Any idea please?

Re: No event from WinEventLog://Microsoft-Windows-TaskScheduler/Operational

hrawat — Wed, 24 Jul 2019 05:44:26 GMT

How is routeC2 defined in transforms.conf?

topic No event from WinEventLog://Microsoft-Windows-TaskScheduler/Operational in Getting Data In

No event from WinEventLog://Microsoft-Windows-TaskScheduler/Operational

Re: No event from WinEventLog://Microsoft-Windows-TaskScheduler/Operational