topic Re: Universal forwarder is not collecting events on Forwarded Folder of windows server in Getting Data In

Universal forwarder is not collecting events on Forwarded Folder of windows server

AKG — Fri, 11 May 2012 06:28:59 GMT

Hi All I am new to Splunk and having some issue...

we have a windows 2008r2 server setup as an event collector for windows servers. Event logs from windows server is being forwarded to this server and goes on to "Forwarded Events" folder.

Now I installed universal forwarder on this server with only "Forwarded Events Log" selected. When i go to splunk server, I can't see any events coming.

if I install with other option selected(e.g. Application Log), I can see application log of that server appearing on splunk server.

I was wondering if i am missing something and will appreciate if some one can guide me.

Note:- we have decided not to install splunk agents in every server and not to use wmi as the number of windows we have is lot(in hundreds).

Thank you in Advance.

Re: Universal forwarder is not collecting events on Forwarded Folder of windows server

rovechkin_splun — Tue, 22 May 2012 18:20:05 GMT

the is a slight bug in default configuration. The issue is that "Forwarded Events" have a space between them, while Windows ForwardedEvents event log doesn't. The workaround is to find all occurrences of "Forwarded Events" in *.conf stanzas and remove space, e.g.

Splunk\etc>find /s "Forwarded Events" *.conf

inputs.conf: [WinEventLog:Forwarded Events]

replace with [WinEventLog:ForwardedEvents]

reboot Splunk.

Re: Universal forwarder is not collecting events on Forwarded Folder of windows server

kmjackson788 — Wed, 06 Feb 2013 14:39:33 GMT

That fixes it.

%SystemRoot%\System32\Winevt\Logs\ForwardedEvents.evtx

The space [WinEventLog:Forwarded Events] does not work. Hopefully they fixed the documentation. ( I sent a documentation fix)

http://docs.splunk.com/Documentation/Splunk/5.0.1/admin/Inputsconf

I dont have enough credit to upvote the above answer.

Re: Universal forwarder is not collecting events on Forwarded Folder of windows server

kmjackson788 — Wed, 06 Feb 2013 18:51:04 GMT

They fixed the docs on inputs.conf. @rovechikin Should of submitted a change on the docs inputs.conf page to save people the frustration.