topic Splunk Universal Forwarder - Splunk_TA_windows addon in Getting Data In

Splunk Universal Forwarder - Splunk_TA_windows addon

africates — Fri, 12 Jun 2020 11:51:04 GMT

Hi,

Anybody knows how to include the windows server backup logs using Splunk_TA_windows addon? I have tried adding the following configuration to local\inputs.conf but it does not seem to work.

[WinEventLog:Microsoft-Windows-Backup/Operational]
disabled = 0
index = wineventlog
renderXml=false
start_from = oldest
checkpointInterval = 5

Any suggestions please?

Re: Splunk Universal Forwarder - Splunk_TA_windows addon

harsmarvania57 — Fri, 12 Jun 2020 12:37:36 GMT

Hi,

Can you please try below stanza ?

[WinEventLog://Microsoft-Windows-Backup] disabled = 0 index = wineventlog renderXml=false start_from = oldest checkpointInterval = 5

Update: stanza updated.

Re: Splunk Universal Forwarder - Splunk_TA_windows addon

africates — Mon, 15 Jun 2020 12:40:09 GMT

Thanks @harsmarvania57 . This seems to work.

Thanks a lot!