https://community.splunk.com/t5/Splunk-Search/How-to-configure-the-input-for-ADFS/m-p/348305#M162355 <P>Based on what I've found I configured the following inputs.conf in a test tier as follows:<BR /> [WinEventLog://AD FS/Admin]<BR /> disabled = 0<BR /> sourcetype=adfs:winevt:admin.evtx<BR /> index=adfs</P> <P>Nothing is being ingested. What am I missing???</P> Tue, 13 Mar 2018 21:00:31 GMT MikeBertelsen 2018-03-13T21:00:31Z https://community.splunk.com/t5/Splunk-Search/How-to-configure-the-input-for-ADFS/m-p/348305#M162355 <P>Based on what I've found I configured the following inputs.conf in a test tier as follows:<BR /> [WinEventLog://AD FS/Admin]<BR /> disabled = 0<BR /> sourcetype=adfs:winevt:admin.evtx<BR /> index=adfs</P> <P>Nothing is being ingested. What am I missing???</P> Tue, 13 Mar 2018 21:00:31 GMT https://community.splunk.com/t5/Splunk-Search/How-to-configure-the-input-for-ADFS/m-p/348305#M162355 MikeBertelsen 2018-03-13T21:00:31Z https://community.splunk.com/t5/Splunk-Search/How-to-configure-the-input-for-ADFS/m-p/348306#M162356 <P>Can you check below command:<BR /> ./splunk list eventlog</P> Wed, 14 Mar 2018 08:17:49 GMT https://community.splunk.com/t5/Splunk-Search/How-to-configure-the-input-for-ADFS/m-p/348306#M162356 p_gurav 2018-03-14T08:17:49Z https://community.splunk.com/t5/Splunk-Search/How-to-configure-the-input-for-ADFS/m-p/348307#M162357 <P>I ran the cli and all that displayed was:<BR /> Monitored Inputs</P> Wed, 14 Mar 2018 14:30:44 GMT https://community.splunk.com/t5/Splunk-Search/How-to-configure-the-input-for-ADFS/m-p/348307#M162357 MikeBertelsen 2018-03-14T14:30:44Z https://community.splunk.com/t5/Splunk-Search/How-to-configure-the-input-for-ADFS/m-p/348308#M162358 <P>The logs are there in files, right?</P> Thu, 15 Mar 2018 04:28:17 GMT https://community.splunk.com/t5/Splunk-Search/How-to-configure-the-input-for-ADFS/m-p/348308#M162358 p_gurav 2018-03-15T04:28:17Z https://community.splunk.com/t5/Splunk-Search/How-to-configure-the-input-for-ADFS/m-p/348309#M162359 <P>yes the data is in the logs</P> Wed, 21 Mar 2018 14:19:07 GMT https://community.splunk.com/t5/Splunk-Search/How-to-configure-the-input-for-ADFS/m-p/348309#M162359 MikeBertelsen 2018-03-21T14:19:07Z https://community.splunk.com/t5/Splunk-Search/How-to-configure-the-input-for-ADFS/m-p/348310#M162360 <P>We had a group review the issue and the problem was the inputs.conf was now under a "local\" directory.</P> Wed, 21 Mar 2018 14:31:57 GMT https://community.splunk.com/t5/Splunk-Search/How-to-configure-the-input-for-ADFS/m-p/348310#M162360 MikeBertelsen 2018-03-21T14:31:57Z