topic Re: WinEventlog Input for [WinEventLog://Microsoft-Windows-Shell-Core/AppDefaults] in Getting Data In

WinEventlog Input for [WinEventLog://Microsoft-Windows-Shell-Core/AppDefaults]

dkeck — Wed, 30 Sep 2020 03:56:22 GMT

Hi,

I try to monitor Microsoft-Windows-Shell-Core/AppDefaults directory.

I tried adding it to Splunk_TA_windows by adding an input stanza in inputs.conf

looking like:

[WinEventLog://Microsoft-Windows-Shell-Core/AppDefaults]
disabled = 1
start_from = oldest
current_only = 0
checkpointInterval = 5
renderXml=true
index=test_windows

But no data is indexed. I also tried [WinEventLog:Microsoft-Windows-Shell-Core/AppDefaults], makes no difference.

Data is displayed within the event viewer.

Since its a non-default input channel I assume there is no default channel in the Splunk_TA_windows??

Any help is appreciated.

Thank you

David

Re: WinEventlog Input for [WinEventLog://Microsoft-Windows-Shell-Core/AppDefaults]

gcusello — Wed, 29 Jan 2020 08:08:28 GMT

Hi @dkeck,
if you used the configuration you shared, the problem is on disable=1 that means no input!
If you want a log, you have to configure disable=0 in that stanza.
Anyway, the correct approach is:

take the Splunk TA_Windows,
put disable=0 in all the stanzas you need,
deploy the TA to your forwarders,
restart Splunk on Forwarders.

You can deploy TAs manually or using a Deployment Server.

Ciao.
Giuseppe

Re: WinEventlog Input for [WinEventLog://Microsoft-Windows-Shell-Core/AppDefaults]

dkeck — Wed, 29 Jan 2020 08:24:37 GMT

Ok thank you.

I was to stupid, disabled 1 always gets me...

Okay its working with [WinEventLog://Microsoft-Windows-Shell-Core/AppDefaults]

Re: WinEventlog Input for [WinEventLog://Microsoft-Windows-Shell-Core/AppDefaults]

gcusello — Wed, 29 Jan 2020 09:08:07 GMT

No Problem! You're welcomw.
Ciao and next Time.
Giuseppe