https://community.splunk.com/t5/Getting-Data-In/Windows-Forwarded-Events-from-UF-on-WEC-are-not-being-ingested/m-p/480272#M82362 <P>Hi <BR /> I have a Windows Server Collecting WinEventLogs from a number windows host endpoints.<BR /> I was told the Server was a WEC, Windows Event Collector, unfortunately I don't have access to it.<BR /> The UF is install and has the following inputs.conf however I am not receiving the ForwardedEvents.</P> <P>Is this inputs correct for collecting the Forwarded Events? Any advise T-shooting is appreciated. Thank you!</P> <PRE><CODE>[WinEventLog://Application] disabled=0 index = &lt;idx_name&gt; [WinEventLog://Security] disabled=0 index = &lt;idx_name&gt; [WinEventLog://System] disabled=0 index = &lt;idx_name&gt; [WinEventLog://ForwardedEvents] disabled=0 index = &lt;idx_name&gt; </CODE></PRE> Fri, 17 Apr 2020 17:21:12 GMT Glasses 2020-04-17T17:21:12Z https://community.splunk.com/t5/Getting-Data-In/Windows-Forwarded-Events-from-UF-on-WEC-are-not-being-ingested/m-p/480272#M82362 <P>Hi <BR /> I have a Windows Server Collecting WinEventLogs from a number windows host endpoints.<BR /> I was told the Server was a WEC, Windows Event Collector, unfortunately I don't have access to it.<BR /> The UF is install and has the following inputs.conf however I am not receiving the ForwardedEvents.</P> <P>Is this inputs correct for collecting the Forwarded Events? Any advise T-shooting is appreciated. Thank you!</P> <PRE><CODE>[WinEventLog://Application] disabled=0 index = &lt;idx_name&gt; [WinEventLog://Security] disabled=0 index = &lt;idx_name&gt; [WinEventLog://System] disabled=0 index = &lt;idx_name&gt; [WinEventLog://ForwardedEvents] disabled=0 index = &lt;idx_name&gt; </CODE></PRE> Fri, 17 Apr 2020 17:21:12 GMT https://community.splunk.com/t5/Getting-Data-In/Windows-Forwarded-Events-from-UF-on-WEC-are-not-being-ingested/m-p/480272#M82362 Glasses 2020-04-17T17:21:12Z