topic Re: How to forward Windows Event Viewer HPC Server logs with inputs.conf? , in Getting Data In

How to forward Windows Event Viewer HPC Server logs with inputs.conf? ,

mdu23 — Wed, 23 May 2018 05:10:29 GMT

I currently use inputs.conf file to forward Windows Event Viewer Application logs to Splunk via the following syntax:
[WinEventLog://Application]
disabled = 0

I'm wondering if anyone knows the Syntax to forward "Windows HPC Server" logs to Splunk?

Thanks!
Michael.

Re: How to forward Windows Event Viewer HPC Server logs with inputs.conf? ,

p_gurav — Wed, 23 May 2018 05:16:18 GMT

This may help:
https://social.microsoft.com/Forums/en-US/b72b13d7-24ca-4c57-941b-8b37da198be5/feed-hpc-logs-into-splunk?forum=windowshpcitpros

Re: How to forward Windows Event Viewer HPC Server logs with inputs.conf? ,

mdu23 — Wed, 23 May 2018 23:22:54 GMT

Hi Gurav,

I think the way we send logs to Splunk is a little different to solution proposed by the Microsoft forum. We currently use AWS Cloud to spin up Windows Servers. We spend HPC logs via inputs.conf file linked to our Json code. The content of the inputs.conf file looks like:

[WinEventLog://Application]
disabled = 0

[WinEventLog://Security]
disabled = 0

[WinEventLog://System]
disabled = 0

I want to ask if anyone knows the Syntax for adding Window HPC Server logs to the inputs.conf file??? The actual Event Viewer logs in Windows can be found under: Event Viewer (Local) > Application and Services Logs > Windows HPC Server.

Thanks
Michael