topic Re: WinEventLog question in Getting Data In

WinEventLog question

santiagn — Fri, 23 Jun 2017 15:13:41 GMT

i added the below to my inputs.conf and restarted the forwarder service but when i search my host it still does not return any wineventlogs. am i missing something or doing something wrong?

[WinEventLog://Application]
disabled = 0

[WinEventLog://Security]
disabled = 0

[WinEventLog://System]
disabled = 0

Re: WinEventLog question

gcusello — Tue, 29 Sep 2020 14:38:46 GMT

Hi santiagn,
if you want to ingest Windows Event Logs the easiest way is to install on Forwarder Splunk_TA_Windows, enabling only stanzas that you want.

Anyway, in your inputs.conf there isn't any index so try inserting in your search index=main

If there still aren't any logs, verify if your indexer receives logs from the forwarder using this search index=_internal host=your_host
In this way you verify if your forwarder is correctly connected to Indexer.

If not, verify firewalls ans outputs.conf in your forwarder.
If you have _internal logs, verify that forwarder and indexer are time aligned and that Windows on forwarder create logs (verify policies).

Bye.
Giuseppe

Re: WinEventLog question

cmerriman — Fri, 23 Jun 2017 15:24:31 GMT

I have been facing the same issue. Check to make sure your ports are allowed to send data.

go to the Windows Firewall with Advanced Security and check the inbound rules. look for the port your host is on. if it isn't there, add a rule for it, and see if that fixes any issues.

Re: WinEventLog question

santiagn — Fri, 23 Jun 2017 15:28:37 GMT

adding index=main made it work.

thanks so much!

Re: WinEventLog question

santiagn — Fri, 23 Jun 2017 15:29:40 GMT

thanks! but i should've mentioned that i have cpu load and avail memory already working just the wineventlog stanza wasn't.