https://community.splunk.com/t5/Installation/software-uninstalled/m-p/495873#M10439 <P>Greetings @riqbal47010,</P> <P>Yes, this is possible with the Windows TA. See documentation below. Of particular interest to you is WinEventLog in the third link. You can also check out the <CODE>inputs.conf</CODE> in the <CODE>default</CODE> directory after installing the add-on (note that all inputs are disabled by default - you can copy stanzas into a new <CODE>inputs.conf</CODE> in the <CODE>local</CODE> directory in order to enable Event Log monitoring). <CODE>11724</CODE> is the Windows Application Event Code that documents uninstallations.</P> <P><A href="https://splunkbase.splunk.com/app/742/#/details">https://splunkbase.splunk.com/app/742/#/details</A><BR /> <A href="https://docs.splunk.com/Documentation/WindowsAddOn/latest/User/AbouttheSplunkAdd-onforWindows">https://docs.splunk.com/Documentation/WindowsAddOn/latest/User/AbouttheSplunkAdd-onforWindows</A><BR /> <A href="https://docs.splunk.com/Documentation/WindowsAddOn/6.0.0/User/Configuration">https://docs.splunk.com/Documentation/WindowsAddOn/6.0.0/User/Configuration</A></P> Mon, 30 Sep 2019 14:40:58 GMT jacobpevans 2019-09-30T14:40:58Z https://community.splunk.com/t5/Installation/software-uninstalled/m-p/495872#M10438 <P>Dear All,</P> <P>how can I know that if someone uninstall anti virus solution on windows server or client. can we get that logs with windows TA ?</P> Mon, 30 Sep 2019 06:58:42 GMT https://community.splunk.com/t5/Installation/software-uninstalled/m-p/495872#M10438 riqbal47010 2019-09-30T06:58:42Z https://community.splunk.com/t5/Installation/software-uninstalled/m-p/495873#M10439 <P>Greetings @riqbal47010,</P> <P>Yes, this is possible with the Windows TA. See documentation below. Of particular interest to you is WinEventLog in the third link. You can also check out the <CODE>inputs.conf</CODE> in the <CODE>default</CODE> directory after installing the add-on (note that all inputs are disabled by default - you can copy stanzas into a new <CODE>inputs.conf</CODE> in the <CODE>local</CODE> directory in order to enable Event Log monitoring). <CODE>11724</CODE> is the Windows Application Event Code that documents uninstallations.</P> <P><A href="https://splunkbase.splunk.com/app/742/#/details">https://splunkbase.splunk.com/app/742/#/details</A><BR /> <A href="https://docs.splunk.com/Documentation/WindowsAddOn/latest/User/AbouttheSplunkAdd-onforWindows">https://docs.splunk.com/Documentation/WindowsAddOn/latest/User/AbouttheSplunkAdd-onforWindows</A><BR /> <A href="https://docs.splunk.com/Documentation/WindowsAddOn/6.0.0/User/Configuration">https://docs.splunk.com/Documentation/WindowsAddOn/6.0.0/User/Configuration</A></P> Mon, 30 Sep 2019 14:40:58 GMT https://community.splunk.com/t5/Installation/software-uninstalled/m-p/495873#M10439 jacobpevans 2019-09-30T14:40:58Z