https://community.splunk.com/t5/Getting-Data-In/Unable-to-get-events-indexed-from-WinEventLog-Setup-and/m-p/355703#M95977 <P>I have deployed SplunK_TA_Windows and setup monitoring for Applicatiom, System ,Security, HardwareEvents and Setup winevents.I am missing logs from Setup and HardwareEvents ,below is the way I setup the Monitorings,</P> <P>[WinEventLog:HardwareEvents]<BR /> disabled = 0<BR /> start_from = oldest<BR /> current_only = 0<BR /> checkpointInterval = 5<BR /> index=xyz</P> <P>[WinEventLog:HardwareEvents]<BR /> disabled = 0<BR /> start_from = oldest<BR /> current_only = 0<BR /> checkpointInterval = 5<BR /> index=xyz</P> <P>Any help how to troubleshoot it and get data indexed into splunk???</P> Tue, 29 Sep 2020 14:30:57 GMT rangineniarunku 2020-09-29T14:30:57Z https://community.splunk.com/t5/Getting-Data-In/Unable-to-get-events-indexed-from-WinEventLog-Setup-and/m-p/355703#M95977 <P>I have deployed SplunK_TA_Windows and setup monitoring for Applicatiom, System ,Security, HardwareEvents and Setup winevents.I am missing logs from Setup and HardwareEvents ,below is the way I setup the Monitorings,</P> <P>[WinEventLog:HardwareEvents]<BR /> disabled = 0<BR /> start_from = oldest<BR /> current_only = 0<BR /> checkpointInterval = 5<BR /> index=xyz</P> <P>[WinEventLog:HardwareEvents]<BR /> disabled = 0<BR /> start_from = oldest<BR /> current_only = 0<BR /> checkpointInterval = 5<BR /> index=xyz</P> <P>Any help how to troubleshoot it and get data indexed into splunk???</P> Tue, 29 Sep 2020 14:30:57 GMT https://community.splunk.com/t5/Getting-Data-In/Unable-to-get-events-indexed-from-WinEventLog-Setup-and/m-p/355703#M95977 rangineniarunku 2020-09-29T14:30:57Z https://community.splunk.com/t5/Getting-Data-In/Unable-to-get-events-indexed-from-WinEventLog-Setup-and/m-p/355704#M95978 <P>verify your inputs<BR /> you are missing //</P> <PRE><CODE>[WinEventLog://HardwareEvents] disabled = 0 start_from = oldest current_only = 0 checkpointInterval = 5 index=xyz [WinEventLog://HardwareEvents] disabled = 0 start_from = oldest current_only = 0 checkpointInterval = 5 index=xyz </CODE></PRE> <P>here is a screenshot after applying the windows setup monitoring as above and verifying data is indexed:<BR /> <span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/3084iEB14B909CFBB94C1/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Fri, 16 Jun 2017 12:53:04 GMT https://community.splunk.com/t5/Getting-Data-In/Unable-to-get-events-indexed-from-WinEventLog-Setup-and/m-p/355704#M95978 adonio 2017-06-16T12:53:04Z