topic Re: WinEventLog - Appliction and Services Logs in Splunk Search

WinEventLog - Appliction and Services Logs- Does anyone have a doc or suggestion?

ttiller — Thu, 26 May 2022 20:38:25 GMT

Trying to collect information from a sub folder in a Windows server event log. Specifically in the Applications and Services Logs/DFS Replication folder. So far it looks like I need to add some info to my local conf file, but unsure of the proper syntax. I believe it would be along these lines:

[WinEventLog:"Application and Services Logs/DFSReplication"]
disabled=0
start from=oldest
currentonly=0

Can anyone point me to the proper doc to figure this out or offer a suggestion. Thanks in advance.

Re: WinEventLog - Appliction and Services Logs

richgalloway — Fri, 14 Aug 2020 15:11:29 GMT

Have you tried removing the quotation marks from the stanza name?

Re: WinEventLog - Appliction and Services Logs

ttiller — Fri, 14 Aug 2020 15:17:23 GMT

I have not. I was unsure if I was even on the right track and did not want to jump off the cliff without some assurances that I'm not going to screw something up. "Nothing ventured nothing gained" as they say. Will give it a go and let you know. Thanks

Re: WinEventLog - Appliction and Services Logs

ttiller — Mon, 31 Aug 2020 18:45:07 GMT

The adjustment was made on the backend so now my search should be successful. Thank you for your suggestion.

Re: WinEventLog - Appliction and Services Logs

richgalloway — Mon, 31 Aug 2020 20:58:39 GMT

If your problem is resolved, then please click the "Accept as Solution" button to help future readers.

Re: WinEventLog - Appliction and Services Logs

wcolgate_splunk — Thu, 26 May 2022 20:35:42 GMT

The syntax for Windows event log stanza is:

[WinEventLog://<channel-name>]