topic Re: Windows log ingestion issue in Feedback

Windows log ingestion issue

test1022 — Wed, 09 Jul 2025 11:08:32 GMT

As stated in the subject, we are currently unable to ingest Windows logs.

It appears that the installation has been completed, and that the Splunk Add-on for Windows has been installed on both the Universal Forwarder and the Splunk platform. However, no data is being ingested at all.

We would like you to check the current state to determine what is happening.

Re: Windows log ingestion issue

richgalloway — Wed, 09 Jul 2025 12:11:27 GMT

This forum is for questions and answers about Splunk products. It's not a consultation service. If you need someone to look at your system then Splunk offers On Demand Services and Professional Services for that.

Have you enabled inputs in the Splunk Add-on for Windows on the UF? Did you restart the forwarder after enabling the inputs? How did you determine no data is being ingested?

Re: Windows log ingestion issue

livehybrid — Mon, 14 Jul 2025 21:49:25 GMT

Hi @test1022

Are you able to see the _internal logs for your Universal Forwarder (UF) host in your Splunk deployment? This would indicate that it is succesfully connecting to your indexer(s), if this is the case then I would validate that the Windows app inputs are enabled on your UF.

From the UF run a btool to check that disabled is not false/0 for the desired Windows inputs:

$SPLUNK_HOME/bin/splunk cmd btool inputs list --debug

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing