https://community.splunk.com/t5/Getting-Data-In/Onboard-Windows-events-DNS-application-logs/m-p/512509#M86936 <P>Yes it resolved. Thanks !!</P> Wed, 05 Aug 2020 06:31:46 GMT Mayanakhan 2020-08-05T06:31:46Z https://community.splunk.com/t5/Getting-Data-In/Onboard-Windows-events-DNS-application-logs/m-p/511284#M86847 <P>Hi,&nbsp;</P><P>I am trying to on-board the DNS application logs from windows servers 2012&nbsp;<SPAN>event logs -&gt; "Application and Services Logs" -&gt; "DNS Server" .</SPAN></P><P>&nbsp;</P><P><SPAN><span class="lia-inline-image-display-wrapper lia-image-align-left" image-alt="DNS.JPG" style="width: 803px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/9902i66D6D161932657C7/image-size/large?v=v2&amp;px=999" role="button" title="DNS.JPG" alt="DNS.JPG" /></span><BR /><BR /></SPAN></P><P><SPAN>I have add the below stanza in inputs.conf for forwarder but data is not injecting.&nbsp;</SPAN></P><LI-CODE lang="markup">[WinEventLog:DNS-Server] disabled = 0</LI-CODE><P>&nbsp;</P><P>do i need to change anything in inputs.conf?</P> Tue, 28 Jul 2020 09:07:19 GMT https://community.splunk.com/t5/Getting-Data-In/Onboard-Windows-events-DNS-application-logs/m-p/511284#M86847 Mayanakhan 2020-07-28T09:07:19Z https://community.splunk.com/t5/Getting-Data-In/Onboard-Windows-events-DNS-application-logs/m-p/511337#M86855 <P>In my inputs.conf file, the stanza name is&nbsp;<FONT face="courier new,courier">[WinEventLog://DNS Server] (space instead of hyphen).</FONT></P> Tue, 28 Jul 2020 13:35:55 GMT https://community.splunk.com/t5/Getting-Data-In/Onboard-Windows-events-DNS-application-logs/m-p/511337#M86855 richgalloway 2020-07-28T13:35:55Z https://community.splunk.com/t5/Getting-Data-In/Onboard-Windows-events-DNS-application-logs/m-p/512509#M86936 <P>Yes it resolved. Thanks !!</P> Wed, 05 Aug 2020 06:31:46 GMT https://community.splunk.com/t5/Getting-Data-In/Onboard-Windows-events-DNS-application-logs/m-p/512509#M86936 Mayanakhan 2020-08-05T06:31:46Z