Bitlocker Windows Events Inputs.conf

aleckostiner123 — Mon, 03 Feb 2020 17:43:28 GMT

I'm trying to get bitlocker events into Splunk. Below is what I have in the inputs.conf and it appears to not be working.

[WinEventLog://Microsoft-Windows-BitLocker/BitLocker Management]
index = main
disabled = 0

Re: Bitlocker Windows Events Inputs.conf

FlorianScho — Mon, 17 Jun 2024 19:33:31 GMT

Hi,
I know this post is quite old but anyway, here is my stanza which is working fine:

[WinEventLog://Microsoft-Windows-BitLocker/BitLocker Management]
index = windows
disabled = 0
renderXml = 1
evt_resolve_ad_obj= 1
start_from = oldest
current_only = 0
checkpointInterval = 5
sourcetype=XmlWinEventLog

Did you check the Splunkd.log on you UF on start? Maybe the user running Splunk Forwarder Service is not able to access the logs.
Or there are just no logs available? On my site it is not written very frequently.
The Splunk_TA_windows is also required on the UF.

topic Bitlocker Windows Events Inputs.conf in Getting Data In

Bitlocker Windows Events Inputs.conf

Re: Bitlocker Windows Events Inputs.conf